Skip to content

K
kernel-hardening-checker
Commit 1bd5e61d by Alexander Popov
Options

Add BPF_UNPRIV_DEFAULT_OFF to cut_attack_surface

parent 02497357
Showing with 1 additions and 0 deletions
kconfig_hardened_check/__init__.py
...@@ -607,6 +607,7 @@ def add_kconfig_checks(l, arch): ...@@ -607,6 +607,7 @@ def add_kconfig_checks(l, arch):
# 'cut_attack_surface', 'my' # 'cut_attack_surface', 'my'
l += [OR(KconfigCheck('cut_attack_surface', 'my', 'TRIM_UNUSED_KSYMS', 'y'), l += [OR(KconfigCheck('cut_attack_surface', 'my', 'TRIM_UNUSED_KSYMS', 'y'),
modules_not_set)] modules_not_set)]
l += [KconfigCheck('cut_attack_surface', 'my', 'BPF_UNPRIV_DEFAULT_OFF', 'y')] # see kernel.unprivileged_bpf_disabled
l += [KconfigCheck('cut_attack_surface', 'my', 'MMIOTRACE', 'is not set')] # refers to LOCKDOWN (permissive) l += [KconfigCheck('cut_attack_surface', 'my', 'MMIOTRACE', 'is not set')] # refers to LOCKDOWN (permissive)
l += [KconfigCheck('cut_attack_surface', 'my', 'LIVEPATCH', 'is not set')] l += [KconfigCheck('cut_attack_surface', 'my', 'LIVEPATCH', 'is not set')]
l += [KconfigCheck('cut_attack_surface', 'my', 'IP_DCCP', 'is not set')] l += [KconfigCheck('cut_attack_surface', 'my', 'IP_DCCP', 'is not set')]
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment