From cf20e03180e4c9841e7d0cb2f97418996ebd3148 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Wed, 17 Apr 2024 19:12:12 +0300 Subject: [PATCH] Fix 'decision' for the X86_USER_SHADOW_STACK check Refers to #114, #120 --- kernel_hardening_checker/checks.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 21f4d2f..5ec19cc 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -400,8 +400,6 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('cut_attack_surface', 'a13xp0p0v', 'MODULE_FORCE_LOAD', 'is not set')] # 'harden_userspace' - if arch == 'X86_64': - l += [KconfigCheck('harden_userspace', 'defconfig', 'X86_USER_SHADOW_STACK', 'y')] if arch == 'ARM64': l += [KconfigCheck('harden_userspace', 'defconfig', 'ARM64_PTR_AUTH', 'y')] l += [KconfigCheck('harden_userspace', 'defconfig', 'ARM64_BTI', 'y')] @@ -409,6 +407,8 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('harden_userspace', 'defconfig', 'VMSPLIT_3G', 'y')] l += [KconfigCheck('harden_userspace', 'clipos', 'COREDUMP', 'is not set')] l += [KconfigCheck('harden_userspace', 'a13xp0p0v', 'ARCH_MMAP_RND_BITS', 'MAX')] # 'MAX' value is refined using ARCH_MMAP_RND_BITS_MAX + if arch == 'X86_64': + l += [KconfigCheck('harden_userspace', 'a13xp0p0v', 'X86_USER_SHADOW_STACK', 'y')] def add_cmdline_checks(l, arch): -- 2.31.1