From 1c655f8d4b554786df6c8e67ed08f6ab8ddbdb96 Mon Sep 17 00:00:00 2001 From: Shawn C Date: Tue, 6 Aug 2024 16:05:45 +0000 Subject: [PATCH] Add ARM SMMU check options Threat model: https://github.com/hardenedlinux/grsecurity-101-tutorials/blob/master/embedded_platform_security.md --- kernel_hardening_checker/checks.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 6b89bd7..2f9d6ff 100755 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -121,6 +121,9 @@ def add_kconfig_checks(l: List[ChecklistObjType], arch: str) -> None: l += [KconfigCheck('self_protection', 'defconfig', 'RODATA_FULL_DEFAULT_ENABLED', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'ARM64_PTR_AUTH_KERNEL', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'ARM64_BTI_KERNEL', 'y')] + l += [KconfigCheck('self_protection', 'defconfig', 'ARM_SMMU', 'y')] + l += [KconfigCheck('self_protection', 'defconfig', 'ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT', 'y')] + l += [KconfigCheck('self_protection', 'defconfig', 'ARM_SMMU_V3', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'MITIGATE_SPECTRE_BRANCH_HISTORY', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'ARM64_MTE', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'RANDOMIZE_MODULE_REGION_FULL', 'y')] -- 2.31.1