Skip to content

K
kernel-hardening-checker
Commit c8652fc9 by Alexander Popov
Options

Add HARDEN_BRANCH_PREDICTOR and HARDEN_EL2_VECTORS

parent 53b9cee7
Showing with 2 additions and 1 deletions
kconfig-hardened-check.py
...@@ -28,7 +28,6 @@ ...@@ -28,7 +28,6 @@
# l1tf=full,force # l1tf=full,force
# mds=full,nosmt # mds=full,nosmt
# ARM64: # ARM64:
# ? CONFIG_HARDEN_BRANCH_PREDICTOR
# kpti=on # kpti=on
# ssbd=force-on # ssbd=force-on
# #
...@@ -192,6 +191,7 @@ def construct_checklist(checklist, arch): ...@@ -192,6 +191,7 @@ def construct_checklist(checklist, arch):
checklist.append(OptCheck('SYN_COOKIES', 'y', 'defconfig', 'self_protection')) # another reason? checklist.append(OptCheck('SYN_COOKIES', 'y', 'defconfig', 'self_protection')) # another reason?
if debug_mode or arch == 'ARM64': if debug_mode or arch == 'ARM64':
checklist.append(OptCheck('UNMAP_KERNEL_AT_EL0', 'y', 'defconfig', 'self_protection')) checklist.append(OptCheck('UNMAP_KERNEL_AT_EL0', 'y', 'defconfig', 'self_protection'))
checklist.append(OptCheck('HARDEN_EL2_VECTORS', 'y', 'defconfig', 'self_protection'))
if debug_mode or arch == 'X86_64' or arch == 'ARM64': if debug_mode or arch == 'X86_64' or arch == 'ARM64':
checklist.append(OptCheck('VMAP_STACK', 'y', 'defconfig', 'self_protection')) checklist.append(OptCheck('VMAP_STACK', 'y', 'defconfig', 'self_protection'))
if debug_mode or arch == 'X86_64' or arch == 'ARM64' or arch == 'X86_32': if debug_mode or arch == 'X86_64' or arch == 'ARM64' or arch == 'X86_32':
...@@ -201,6 +201,7 @@ def construct_checklist(checklist, arch): ...@@ -201,6 +201,7 @@ def construct_checklist(checklist, arch):
checklist.append(OptCheck('CPU_SW_DOMAIN_PAN', 'y', 'defconfig', 'self_protection')) checklist.append(OptCheck('CPU_SW_DOMAIN_PAN', 'y', 'defconfig', 'self_protection'))
if debug_mode or arch == 'ARM64' or arch == 'ARM': if debug_mode or arch == 'ARM64' or arch == 'ARM':
checklist.append(OptCheck('REFCOUNT_FULL', 'y', 'defconfig', 'self_protection')) checklist.append(OptCheck('REFCOUNT_FULL', 'y', 'defconfig', 'self_protection'))
checklist.append(OptCheck('HARDEN_BRANCH_PREDICTOR', 'y', 'defconfig', 'self_protection'))
checklist.append(OptCheck('BUG_ON_DATA_CORRUPTION', 'y', 'kspp', 'self_protection')) checklist.append(OptCheck('BUG_ON_DATA_CORRUPTION', 'y', 'kspp', 'self_protection'))
checklist.append(OptCheck('DEBUG_WX', 'y', 'kspp', 'self_protection')) checklist.append(OptCheck('DEBUG_WX', 'y', 'kspp', 'self_protection'))
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment