Skip to content

K
kernel-hardening-checker
Commit 0c130224 by Alexander Popov
Options

Add the spectre_v2 check

parent 52bd20f0
Showing with 2 additions and 3 deletions
kconfig_hardened_check/__init__.py
...@@ -734,6 +734,8 @@ def add_cmdline_checks(l, arch): ...@@ -734,6 +734,8 @@ def add_cmdline_checks(l, arch):
l += [CmdlineCheck('self_protection', 'defconfig', 'nospectre_v2', 'is not set')] l += [CmdlineCheck('self_protection', 'defconfig', 'nospectre_v2', 'is not set')]
l += [OR(CmdlineCheck('self_protection', 'defconfig', 'mitigations', 'is not off'), l += [OR(CmdlineCheck('self_protection', 'defconfig', 'mitigations', 'is not off'),
CmdlineCheck('self_protection', 'defconfig', 'mitigations', 'is not set'))] CmdlineCheck('self_protection', 'defconfig', 'mitigations', 'is not set'))]
l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spectre_v2', 'is not off'),
CmdlineCheck('self_protection', 'defconfig', 'spectre_v2', 'is not set'))]
if arch == 'ARM64': if arch == 'ARM64':
l += [OR(CmdlineCheck('self_protection', 'defconfig', 'rodata', 'full'), l += [OR(CmdlineCheck('self_protection', 'defconfig', 'rodata', 'full'),
AND(KconfigCheck('self_protection', 'defconfig', 'RODATA_FULL_DEFAULT_ENABLED', 'y'), AND(KconfigCheck('self_protection', 'defconfig', 'RODATA_FULL_DEFAULT_ENABLED', 'y'),
...@@ -780,9 +782,6 @@ def add_cmdline_checks(l, arch): ...@@ -780,9 +782,6 @@ def add_cmdline_checks(l, arch):
# 'self_protection', 'clipos' # 'self_protection', 'clipos'
l += [CmdlineCheck('self_protection', 'clipos', 'page_alloc.shuffle', '1')] l += [CmdlineCheck('self_protection', 'clipos', 'page_alloc.shuffle', '1')]
if arch in ('X86_64', 'X86_32'):
l += [AND(CmdlineCheck('self_protection', 'clipos', 'spectre_v2', 'on'),
CmdlineCheck('self_protection', 'defconfig', 'nospectre_v2', 'is not set'))]
# 'cut_attack_surface', 'kspp' # 'cut_attack_surface', 'kspp'
if arch == 'X86_64': if arch == 'X86_64':
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment