Skip to content

K
kernel-hardening-checker
Commit 0a21c2cc by Alexander Popov
Options

Check X86_MCE, X86_MCE_INTEL, X86_MCE_AMD (recommended by Clip OS) 

These options are enabled by default.
parent fb49a542
Showing with 3 additions and 0 deletions
kconfig_hardened_check/__init__.py
...@@ -365,6 +365,9 @@ def add_kconfig_checks(l, arch): ...@@ -365,6 +365,9 @@ def add_kconfig_checks(l, arch):
if arch in ('X86_64', 'ARM64'): if arch in ('X86_64', 'ARM64'):
l += [KconfigCheck('self_protection', 'defconfig', 'VMAP_STACK', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'VMAP_STACK', 'y')]
if arch in ('X86_64', 'X86_32'): if arch in ('X86_64', 'X86_32'):
l += [KconfigCheck('self_protection', 'defconfig', 'X86_MCE', 'y')]
l += [KconfigCheck('self_protection', 'defconfig', 'X86_MCE_INTEL', 'y')]
l += [KconfigCheck('self_protection', 'defconfig', 'X86_MCE_AMD', 'y')]
l += [KconfigCheck('self_protection', 'defconfig', 'MICROCODE', 'y')] # is needed for mitigating CPU bugs l += [KconfigCheck('self_protection', 'defconfig', 'MICROCODE', 'y')] # is needed for mitigating CPU bugs
l += [KconfigCheck('self_protection', 'defconfig', 'RETPOLINE', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'RETPOLINE', 'y')]
l += [OR(KconfigCheck('self_protection', 'defconfig', 'X86_SMAP', 'y'), l += [OR(KconfigCheck('self_protection', 'defconfig', 'X86_SMAP', 'y'),
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment