From 4e3f9782fec90b034e69709e3d8dcda872891d8a Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Sat, 2 Dec 2023 13:49:42 +0300 Subject: [PATCH] Add a check for the 'kfence.sample_interval' boot parameter Thanks to @izh1979 for the idea --- kernel_hardening_checker/checks.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 9865929..d02eb4b 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -502,6 +502,11 @@ def add_cmdline_checks(l, arch): if arch in ('X86_64', 'X86_32'): l += [CmdlineCheck('self_protection', 'clipos', 'iommu', 'force')] + # 'self_protection', 'my' + l += [OR(CmdlineCheck('self_protection', 'my', 'kfence.sample_interval', 'is not off'), + AND(KconfigCheck('self_protection', 'my', 'KFENCE_SAMPLE_INTERVAL', 'is not off'), + CmdlineCheck('self_protection', 'my', 'kfence.sample_interval', 'is not set')))] + # 'cut_attack_surface', 'defconfig' if arch in ('X86_64', 'X86_32'): l += [OR(CmdlineCheck('cut_attack_surface', 'defconfig', 'tsx', 'off'), -- 2.31.1