From f5aff3de3b57311686211644f8ae36f989e13aed Mon Sep 17 00:00:00 2001 From: Eneas U de Queiroz Date: Fri, 10 Nov 2023 15:02:57 -0300 Subject: [PATCH] Don't fail if dev.tty.legacy_tiocsti not found The sysctl is available for Kernel 6.2 and later only. Signed-off-by: Eneas U de Queiroz --- kernel_hardening_checker/checks.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 9f48d58..0e0f205 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -680,7 +680,8 @@ def add_sysctl_checks(l, _arch): AND(KconfigCheck('cut_attack_surface', 'lockdown', 'BPF_SYSCALL', 'is not set'), have_config_file))] l += [SysctlCheck('cut_attack_surface', 'kspp', 'kernel.kptr_restrict', '2')] - l += [SysctlCheck('cut_attack_surface', 'kspp', 'dev.tty.legacy_tiocsti', '0')] + l += [OR(SysctlCheck('cut_attack_surface', 'kspp', 'dev.tty.legacy_tiocsti', '0'), + SysctlCheck('cut_attack_surface', 'kspp', 'dev.tty.legacy_tiocsti', 'is not set'))] l += [SysctlCheck('cut_attack_surface', 'kspp', 'vm.unprivileged_userfaultfd', '0')] # At first, it disabled unprivileged userfaultfd, # and since v5.11 it enables unprivileged userfaultfd for user-mode only. -- 2.31.1