import sys
from argparse import ArgumentParser
from collections import OrderedDict
+from typing import List, Tuple
import re
import json
from .__about__ import __version__
return open_method(file, *args, **kwargs)
-def detect_arch(fname, archs):
+def detect_arch(fname: str, archs: List[str]) -> Tuple:
with _open(fname, 'rt', encoding='utf-8') as f:
arch_pattern = re.compile(r"CONFIG_[a-zA-Z0-9_]+=y$")
arch = None
return arch, 'OK'
-def detect_kernel_version(fname):
+def detect_kernel_version(fname: str) -> Tuple:
with _open(fname, 'rt', encoding='utf-8') as f:
ver_pattern = re.compile(r"^# Linux/.+ Kernel Configuration$|^Linux version .+")
for line in f.readlines():
return None, 'no kernel version detected'
-def detect_compiler(fname):
+def detect_compiler(fname: str):
gcc_version = None
clang_version = None
with _open(fname, 'rt', encoding='utf-8') as f:
print(f'[?] No check for {opt_type} option {option} ({value})')
-def print_checklist(mode, checklist, with_results):
+def print_checklist(mode: str, checklist, with_results: bool):
if mode == 'json':
output = []
for opt in checklist:
print(f'[+] Config check is finished: \'OK\' - {ok_count}{ok_suppressed} / \'FAIL\' - {fail_count}{fail_suppressed}')
-def parse_kconfig_file(_mode, parsed_options, fname):
+def parse_kconfig_file(_mode, parsed_options, fname: str):
with _open(fname, 'rt', encoding='utf-8') as f:
opt_is_on = re.compile(r"CONFIG_[a-zA-Z0-9_]+=.+$")
opt_is_off = re.compile(r"# CONFIG_[a-zA-Z0-9_]+ is not set$")
from .engine import KconfigCheck, CmdlineCheck, SysctlCheck, VersionCheck, OR, AND
-def add_kconfig_checks(l, arch):
+def add_kconfig_checks(l, arch: str):
assert(arch), 'empty arch'
# Calling the KconfigCheck class constructor:
l += [KconfigCheck('harden_userspace', 'a13xp0p0v', 'X86_USER_SHADOW_STACK', 'y')]
-def add_cmdline_checks(l, arch):
+def add_cmdline_checks(l, arch: str):
assert(arch), 'empty arch'
# Calling the CmdlineCheck class constructor:
]
-def normalize_cmdline_options(option, value):
+def normalize_cmdline_options(option: str, value: str) -> str:
# Don't normalize the cmdline option values if
# the Linux kernel doesn't use kstrtobool() for them
if option in no_kstrtobool_options:
# kernel.warn_limit (think about a proper value)
# net.ipv4.tcp_syncookies=1 (?)
-def add_sysctl_checks(l, _arch):
+def add_sysctl_checks(l, _arch: str):
# This function may be called with arch=None
# Calling the SysctlCheck class constructor:
# pylint: disable=missing-class-docstring,missing-function-docstring
# pylint: disable=line-too-long,invalid-name,too-many-branches
+from typing import Dict, Tuple
import sys
GREEN_COLOR = '\x1b[32m'
class OptCheck:
- def __init__(self, reason, decision, name, expected):
+ def __init__(self, reason: str, decision: str, name: str, expected: str):
assert(name and name == name.strip() and len(name.split()) == 1), \
f'invalid name "{name}" for {self.__class__.__name__}'
self.name = name
else:
self.result = f'FAIL: "{self.state}"'
- def table_print(self, _mode, with_results):
+ def table_print(self, _mode, with_results: bool):
print(f'{self.name:<40}|{self.opt_type:^7}|{self.expected:^12}|{self.decision:^10}|{self.reason:^18}', end='')
if with_results:
print(f'| {colorize_result(self.result)}', end='')
- def json_dump(self, with_results):
+ def json_dump(self, with_results: bool) -> Dict:
dump = {
"option_name": self.name,
"type": self.opt_type,
class VersionCheck:
- def __init__(self, ver_expected):
+ def __init__(self, ver_expected: Tuple):
assert(ver_expected and isinstance(ver_expected, tuple) and len(ver_expected) == 3), \
f'invalid expected version "{ver_expected}" for VersionCheck (1)'
assert(all(map(lambda x: isinstance(x, int), ver_expected))), \
def opt_type(self):
return 'version'
- def set_state(self, data):
+ def set_state(self, data: Tuple):
assert(data and isinstance(data, tuple) and len(data) >= 3), \
f'invalid version "{data}" for VersionCheck'
self.ver = data[:3]
return
self.result = f'FAIL: version < {self.ver_expected}'
- def table_print(self, _mode, with_results):
+ def table_print(self, _mode, with_results: bool):
ver_req = f'kernel version >= {self.ver_expected}'
print(f'{ver_req:<91}', end='')
if with_results:
def expected(self):
return self.opts[0].expected
- def table_print(self, mode, with_results):
+ def table_print(self, mode: str, with_results: bool):
if mode == 'verbose':
class_name = f'<<< {self.__class__.__name__} >>>'
print(f' {class_name:87}', end='')
if with_results:
print(f'| {colorize_result(self.result)}', end='')
- def json_dump(self, with_results):
+ def json_dump(self, with_results: bool) -> Dict:
dump = self.opts[0].json_dump(False)
if with_results:
# Add the 'check_result' and 'check_result_bool' keys to the dictionary
SIMPLE_OPTION_TYPES = ('kconfig', 'cmdline', 'sysctl', 'version')
-def populate_simple_opt_with_data(opt, data, data_type):
+def populate_simple_opt_with_data(opt, data, data_type: str):
assert(opt.opt_type != 'complex'), \
f'unexpected ComplexOptCheck "{opt.name}"'
assert(opt.opt_type in SIMPLE_OPTION_TYPES), \
projects / kconfig-hardened-check.git / commitdiff