From: Alexander Popov <alex.popov@linux.com>
Date: Sat, 2 Dec 2023 10:04:30 +0000 (+0300)
Subject: Add the KFENCE_SAMPLE_INTERVAL check
X-Git-Tag: v0.6.6~45
X-Git-Url: https://jxself.org/git/?p=kconfig-hardened-check.git;a=commitdiff_plain;h=0d751b9101e8eb16f08ae3ee4e9a91f360ea5779

Add the KFENCE_SAMPLE_INTERVAL check

Thanks to @izh1979 for the idea
---

diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py
index d95d301..9865929 100644
--- a/kernel_hardening_checker/checks.py
+++ b/kernel_hardening_checker/checks.py
@@ -117,9 +117,12 @@ def add_kconfig_checks(l, arch):
     l += [KconfigCheck('self_protection', 'kspp', 'DEBUG_CREDENTIALS', 'y')]
     l += [KconfigCheck('self_protection', 'kspp', 'DEBUG_NOTIFIERS', 'y')]
     l += [KconfigCheck('self_protection', 'kspp', 'INIT_ON_ALLOC_DEFAULT_ON', 'y')]
-    l += [KconfigCheck('self_protection', 'kspp', 'KFENCE', 'y')]
     l += [KconfigCheck('self_protection', 'kspp', 'HW_RANDOM_TPM', 'y')]
     l += [KconfigCheck('self_protection', 'kspp', 'STATIC_USERMODEHELPER', 'y')] # needs userspace support
+    kfence_is_set = KconfigCheck('self_protection', 'kspp', 'KFENCE', 'y')
+    l += [kfence_is_set]
+    l += [AND(KconfigCheck('self_protection', 'my', 'KFENCE_SAMPLE_INTERVAL', 'is not off'),
+              kfence_is_set)]
     randstruct_is_set = OR(KconfigCheck('self_protection', 'kspp', 'RANDSTRUCT_FULL', 'y'),
                            KconfigCheck('self_protection', 'kspp', 'GCC_PLUGIN_RANDSTRUCT', 'y'))
     l += [randstruct_is_set]