Disable only CONFIG_USER_NS, not whole CONFIG_NAMESPACES

Thanks to @Bernhard40 for the correction

Signed-off-by: Alexander Popov <alex.popov@linux.com>

diff --git a/README.md b/README.md
index 8c1af9b646dfb94e4b887e96633e05b70ed1c58c..b87801e58bea593fbf4a0ac109dcad5cb107762d 100644 (file)
--- a/README.md
+++ b/README.md
@@ -95,7 +95,7 @@ Usage: ./kconfig-hardened-check.py [-p | -c <config_file>]
   CONFIG_MODIFY_LDT_SYSCALL              | is not set  |   kspp   | cut_attack_surface ||     FAIL: "y"      
   CONFIG_KEXEC_FILE                      | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
   CONFIG_LIVEPATCH                       | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
-  CONFIG_NAMESPACES                      | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_USER_NS                         | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
   CONFIG_IP_DCCP                         | is not set  |    my    | cut_attack_surface ||     FAIL: "m"      
   CONFIG_FTRACE                          | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
   CONFIG_KPROBES                         | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index a3612dcd59777731e51477c038b9e204be181171..a63df18abaead7a9c6357915d68f0fabb024e377 100755 (executable)
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -94,7 +94,7 @@ def construct_opt_list():
     opt_list.append([Opt('MODIFY_LDT_SYSCALL',   'is not set', 'kspp', 'cut_attack_surface'), ''])
     opt_list.append([Opt('KEXEC_FILE',           'is not set', 'my', 'cut_attack_surface'), ''])
     opt_list.append([Opt('LIVEPATCH',            'is not set', 'my', 'cut_attack_surface'), ''])
-    opt_list.append([Opt('NAMESPACES',           'is not set', 'my', 'cut_attack_surface'), '']) # user.max_user_namespaces=0
+    opt_list.append([Opt('USER_NS',              'is not set', 'my', 'cut_attack_surface'), '']) # user.max_user_namespaces=0
     opt_list.append([Opt('IP_DCCP',              'is not set', 'my', 'cut_attack_surface'), ''])
     opt_list.append([Opt('FTRACE',               'is not set', 'my', 'cut_attack_surface'), ''])
     opt_list.append([Opt('KPROBES',              'is not set', 'my', 'cut_attack_surface'), ''])