LDISC_AUTOLOAD can be disabled since v5.1

This fixes the false positive report about LDISC_AUTOLOAD for old kernels

LDISC_AUTOLOAD can be disabled since v5.1
This fixes the false positive report about LDISC_AUTOLOAD for old kernels
61b5ca3c · Alexander Popov · 17c22224 · 61b5ca3c
Commit 61b5ca3c authored Mar 05, 2020 by Alexander Popov
Show whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletions

kconfig-hardened-check.py kconfig-hardened-check.py +2 -1

No files found.
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -411,7 +411,8 @@ def construct_checklist(checklist, arch):
    checklist.append(OptCheck('MAGIC_SYSRQ',              'is not set', 'clipos', 'cut_attack_surface'))
    checklist.append(OptCheck('KEXEC_FILE',               'is not set', 'clipos', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL (permissive)
    checklist.append(OptCheck('USER_NS',                  'is not set', 'clipos', 'cut_attack_surface')) # user.max_user_namespaces=0
-    checklist.append(OptCheck('LDISC_AUTOLOAD',           'is not set', 'clipos', 'cut_attack_surface'))
+    checklist.append(AND(OptCheck('LDISC_AUTOLOAD',           'is not set', 'clipos', 'cut_attack_surface'), \
+                         VerCheck((5, 1)))) # LDISC_AUTOLOAD can be disabled since v5.1

    checklist.append(OptCheck('MMIOTRACE',            'is not set', 'my', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL (permissive)
    checklist.append(OptCheck('LIVEPATCH',            'is not set', 'my', 'cut_attack_surface'))