Has CONFIG_REFCOUNT_FULL and VMAP_STACK been removed from Kernel-5.5 ? about kernel-hardening-checker

[Bernhard40]

CONFIG_REFCOUNT_FULL was removed but CONFIG_VMAP_STACK is still available.

[a13xp0p0v]

Yes, REFCOUNT_FULL was removed...
Have to find a way how to check it without false positive.

[Bernhard40]

@a13xp0p0v there is kernel version printed in config header, like:

#
# Automatically generated file; DO NOT EDIT.
# Linux/x86 5.5.2 Kernel Configuration
#

maybe you can parse those?

[a13xp0p0v]

Yes, it looks like we have to add some limited kernel version checking...

[a13xp0p0v]

I may have time to work on that only after OffensiveCon.
Does anybody want to prepare a pull request?

[bryn1u]

Hey, Is a CONFIG_HAVE_ARCH_VMAP_STACK in Kernel-5.5.2 equivalent to CONFIG_VMAPSTACK ? Thanks ! czw., 6 lut 2020 o 16:29 Alexander Popov <[email protected]> napisał(a):

…

I may have time to work on that only after OffensiveCon. Does anybody want to prepare a pull request? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#30>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA2PTHBA772R35Y6MYOQS6DRBQUHBANCNFSM4KOS3L2Q> .

[Bernhard40]

Is a CONFIG_HAVE_ARCH_VMAP_STACK in Kernel-5.5.2 equivalent to
CONFIG_VMAPSTACK ?

No CONFIG_HAVE_ARCH_VMAP_STACK tells only if VMAP_STACK is available for specific cpu architecture. CONFIG_VMAP_STACK tells if VMAP_STACK is enabled.

You can check that VMAP_STACK definitely still exist up to 5.6-rc.

[a13xp0p0v]

Hello!

Worked with that issue in 0ace190, 918b12c and 17c2222.

Also have a look at 61b5ca3: that fixes the false positive report about LDISC_AUTOLOAD for old kernels.