Skip to content

K
kernel-hardening-checker
Commit b6ee2f57 by Alexander Popov
Options

Disable only CONFIG_USER_NS, not whole CONFIG_NAMESPACES 

Thanks to @Bernhard40 for the correction

Signed-off-by: Alexander Popov <alex.popov@linux.com>
parent 6b25acb5
Showing with 2 additions and 2 deletions
README.md
......@@ -95,7 +95,7 @@ Usage: ./kconfig-hardened-check.py [-p | -c <config_file>]
CONFIG_MODIFY_LDT_SYSCALL | is not set | kspp | cut_attack_surface || FAIL: "y"
CONFIG_KEXEC_FILE | is not set | my | cut_attack_surface || FAIL: "y"
CONFIG_LIVEPATCH | is not set | my | cut_attack_surface || FAIL: "y"
CONFIG_NAMESPACES | is not set | my | cut_attack_surface || FAIL: "y"
CONFIG_USER_NS | is not set | my | cut_attack_surface || FAIL: "y"
CONFIG_IP_DCCP | is not set | my | cut_attack_surface || FAIL: "m"
CONFIG_FTRACE | is not set | my | cut_attack_surface || FAIL: "y"
CONFIG_KPROBES | is not set | my | cut_attack_surface || FAIL: "y"
......
kconfig-hardened-check.py
......@@ -94,7 +94,7 @@ def construct_opt_list():
opt_list.append([Opt('MODIFY_LDT_SYSCALL', 'is not set', 'kspp', 'cut_attack_surface'), ''])
opt_list.append([Opt('KEXEC_FILE', 'is not set', 'my', 'cut_attack_surface'), ''])
opt_list.append([Opt('LIVEPATCH', 'is not set', 'my', 'cut_attack_surface'), ''])
opt_list.append([Opt('NAMESPACES', 'is not set', 'my', 'cut_attack_surface'), '']) # user.max_user_namespaces=0
opt_list.append([Opt('USER_NS', 'is not set', 'my', 'cut_attack_surface'), '']) # user.max_user_namespaces=0
opt_list.append([Opt('IP_DCCP', 'is not set', 'my', 'cut_attack_surface'), ''])
opt_list.append([Opt('FTRACE', 'is not set', 'my', 'cut_attack_surface'), ''])
opt_list.append([Opt('KPROBES', 'is not set', 'my', 'cut_attack_surface'), ''])
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment