From b7fd998a9cfa6c25fad3a530a15d5ac9a9bf8c83 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Thu, 2 May 2024 14:52:27 +0300 Subject: [PATCH] Fix the reason and decision of the BPF_JIT check KSPP doesn't recommend to disable it. Refers to #125 --- kernel_hardening_checker/checks.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 9093b9b..a1fb941 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -667,7 +667,7 @@ def add_sysctl_checks(l, _arch): have_config_file = KconfigCheck('-', '-', 'LOCALVERSION', 'is present') l += [OR(SysctlCheck('self_protection', 'kspp', 'net.core.bpf_jit_harden', '2'), - AND(KconfigCheck('cut_attack_surface', 'kspp', 'BPF_JIT', 'is not set'), + AND(KconfigCheck('-', '-', 'BPF_JIT', 'is not set'), have_config_file))] l += [SysctlCheck('cut_attack_surface', 'kspp', 'kernel.dmesg_restrict', '1')] -- 2.31.1