Skip to content

K
kernel-hardening-checker
Commit 05113077 by Alexander Popov
Options

Add a tricky check for init_on_alloc and INIT_ON_ALLOC_DEFAULT_ON 

Nice!
parent a23725c2
Showing with 4 additions and 1 deletions
kconfig_hardened_check/__init__.py
...@@ -16,7 +16,6 @@ ...@@ -16,7 +16,6 @@
# iommu.passthrough=0 # iommu.passthrough=0
# iommu.strict=1 # iommu.strict=1
# slub_debug=FZ (slow) # slub_debug=FZ (slow)
# init_on_alloc=1 (since v5.3)
# init_on_free=1 (since v5.3, otherwise slub_debug=P and page_poison=1) # init_on_free=1 (since v5.3, otherwise slub_debug=P and page_poison=1)
# loadpin.enforce=1 # loadpin.enforce=1
# debugfs=no-mount (or off if possible) # debugfs=no-mount (or off if possible)
...@@ -650,6 +649,10 @@ def add_cmdline_checks(l, arch): ...@@ -650,6 +649,10 @@ def add_cmdline_checks(l, arch):
# Calling the CmdlineCheck class constructor: # Calling the CmdlineCheck class constructor:
# CmdlineCheck(reason, decision, name, expected) # CmdlineCheck(reason, decision, name, expected)
l += [OR(CmdlineCheck('self_protection', 'kspp', 'init_on_alloc', '1'),
AND(KconfigCheck('self_protection', 'kspp', 'INIT_ON_ALLOC_DEFAULT_ON', 'y'),
CmdlineCheck('self_protection', 'kspp', 'init_on_alloc', 'is not set')))]
if arch in ('X86_64', 'X86_32'): if arch in ('X86_64', 'X86_32'):
l += [CmdlineCheck('self_protection', 'kspp', 'pti', 'on')] l += [CmdlineCheck('self_protection', 'kspp', 'pti', 'on')]
# TODO: add other # TODO: add other
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment