From 66ec052adea90855c91eb8ec502e3c61ce660e01 Mon Sep 17 00:00:00 2001 From: Willenst Date: Mon, 26 Aug 2024 10:40:01 +0200 Subject: [PATCH] Add io_uring_disabled sysctl check --- kernel_hardening_checker/checks.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 6fcb07d..0cc9e58 100755 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -748,6 +748,10 @@ def add_sysctl_checks(l: List[ChecklistObjType], _arch: StrOrNone) -> None: AND(KconfigCheck('cut_attack_surface', 'kspp', 'MODULES', 'is not set'), have_kconfig))] # radical, but may be useful in some cases + l += [OR(SysctlCheck('cut_attack_surface', 'grsec', 'kernel.io_uring_disabled', '2'), + AND(KconfigCheck('cut_attack_surface', 'grsec', 'IO_URING', 'is not set'), + have_kconfig))] # compatible with the 'IO_URING' kconfig check by grsecurity + l += [OR(SysctlCheck('cut_attack_surface', 'a13xp0p0v', 'kernel.sysrq', '0'), AND(KconfigCheck('cut_attack_surface', 'clipos', 'MAGIC_SYSRQ', 'is not set'), have_kconfig))] -- 2.31.1