4 This tool helps me to check Linux kernel options against
5 my security hardening preferences for X86_64, ARM64, X86_32, and ARM.
6 Let the computers do their job!
8 Author: Alexander Popov <alex.popov@linux.com>
10 This module is the engine of checks.
13 # pylint: disable=missing-class-docstring,missing-function-docstring
14 # pylint: disable=line-too-long,invalid-name,too-many-branches
18 def __init__(self, reason, decision, name, expected):
19 assert(name and name == name.strip() and len(name.split()) == 1), \
20 f'invalid name "{name}" for {self.__class__.__name__}'
23 assert(decision and decision == decision.strip() and len(decision.split()) == 1), \
24 f'invalid decision "{decision}" for "{name}" check'
25 self.decision = decision
27 assert(reason and reason == reason.strip() and len(reason.split()) == 1), \
28 f'invalid reason "{reason}" for "{name}" check'
31 assert(expected and expected == expected.strip()), \
32 f'invalid expected value "{expected}" for "{name}" check (1)'
33 val_len = len(expected.split())
35 assert(expected in ('is not set', 'is not off')), \
36 f'invalid expected value "{expected}" for "{name}" check (2)'
38 assert(expected == 'is present'), \
39 f'invalid expected value "{expected}" for "{name}" check (3)'
41 assert(val_len == 1), \
42 f'invalid expected value "{expected}" for "{name}" check (4)'
43 self.expected = expected
49 # handle the 'is present' check
50 if self.expected == 'is present':
51 if self.state is None:
52 self.result = 'FAIL: is not present'
54 self.result = 'OK: is present'
57 # handle the 'is not off' option check
58 if self.expected == 'is not off':
59 if self.state == 'off':
60 self.result = 'FAIL: is off'
61 elif self.state == '0':
62 self.result = 'FAIL: is off, "0"'
63 elif self.state is None:
64 self.result = 'FAIL: is off, not found'
66 self.result = f'OK: is not off, "{self.state}"'
69 # handle the option value check
70 if self.expected == self.state:
72 elif self.state is None:
73 if self.expected == 'is not set':
74 self.result = 'OK: is not found'
76 self.result = 'FAIL: is not found'
78 self.result = f'FAIL: "{self.state}"'
80 def table_print(self, _mode, with_results):
81 print(f'{self.name:<40}|{self.type:^7}|{self.expected:^12}|{self.decision:^10}|{self.reason:^18}', end='')
83 print(f'| {self.result}', end='')
85 def json_dump(self, with_results):
86 dump = [self.name, self.type, self.expected, self.decision, self.reason]
88 dump.append(self.result)
92 class KconfigCheck(OptCheck):
93 def __init__(self, *args, **kwargs):
94 super().__init__(*args, **kwargs)
95 self.name = 'CONFIG_' + self.name
102 class CmdlineCheck(OptCheck):
109 def __init__(self, ver_expected):
110 assert(ver_expected and isinstance(ver_expected, tuple) and len(ver_expected) == 2), \
111 f'invalid version "{ver_expected}" for VersionCheck'
112 self.ver_expected = ver_expected
121 if self.ver[0] > self.ver_expected[0]:
122 self.result = f'OK: version >= {self.ver_expected[0]}.{self.ver_expected[1]}'
124 if self.ver[0] < self.ver_expected[0]:
125 self.result = f'FAIL: version < {self.ver_expected[0]}.{self.ver_expected[1]}'
127 if self.ver[1] >= self.ver_expected[1]:
128 self.result = f'OK: version >= {self.ver_expected[0]}.{self.ver_expected[1]}'
130 self.result = f'FAIL: version < {self.ver_expected[0]}.{self.ver_expected[1]}'
132 def table_print(self, _mode, with_results):
133 ver_req = f'kernel version >= {self.ver_expected[0]}.{self.ver_expected[1]}'
134 print(f'{ver_req:<91}', end='')
136 print(f'| {self.result}', end='')
139 class ComplexOptCheck:
140 def __init__(self, *opts):
143 f'empty {self.__class__.__name__} check'
144 assert(len(self.opts) != 1), \
145 f'useless {self.__class__.__name__} check: {opts}'
146 assert(isinstance(opts[0], (KconfigCheck, CmdlineCheck))), \
147 f'invalid {self.__class__.__name__} check: {opts}'
156 return self.opts[0].name
160 return self.opts[0].expected
162 def table_print(self, mode, with_results):
163 if mode == 'verbose':
164 print(f' {"<<< " + self.__class__.__name__ + " >>>":87}', end='')
166 print(f'| {self.result}', end='')
169 o.table_print(mode, with_results)
172 o.table_print(mode, False)
174 print(f'| {self.result}', end='')
176 def json_dump(self, with_results):
177 dump = self.opts[0].json_dump(False)
179 dump.append(self.result)
183 class OR(ComplexOptCheck):
184 # self.opts[0] is the option that this OR-check is about.
186 # OR(<X_is_hardened>, <X_is_disabled>)
187 # OR(<X_is_hardened>, <old_X_is_hardened>)
189 for i, opt in enumerate(self.opts):
191 if opt.result.startswith('OK'):
192 self.result = opt.result
193 # Add more info for additional checks:
195 if opt.result == 'OK':
196 self.result = f'OK: {opt.name} is "{opt.expected}"'
197 elif opt.result == 'OK: is not found':
198 self.result = f'OK: {opt.name} is not found'
199 elif opt.result == 'OK: is present':
200 self.result = f'OK: {opt.name} is present'
201 elif opt.result.startswith('OK: is not off'):
202 self.result = f'OK: {opt.name} is not off'
204 # VersionCheck provides enough info
205 assert(opt.result.startswith('OK: version')), \
206 f'unexpected OK description "{opt.result}"'
208 self.result = self.opts[0].result
211 class AND(ComplexOptCheck):
212 # self.opts[0] is the option that this AND-check is about.
214 # AND(<suboption>, <main_option>)
215 # Suboption is not checked if checking of the main_option is failed.
216 # AND(<X_is_disabled>, <old_X_is_disabled>)
218 for i, opt in reversed(list(enumerate(self.opts))):
221 self.result = opt.result
223 if not opt.result.startswith('OK'):
224 # This FAIL is caused by additional checks,
225 # and not by the main option that this AND-check is about.
226 # Describe the reason of the FAIL.
227 if opt.result.startswith('FAIL: \"') or opt.result == 'FAIL: is not found':
228 self.result = f'FAIL: {opt.name} is not "{opt.expected}"'
229 elif opt.result == 'FAIL: is not present':
230 self.result = f'FAIL: {opt.name} is not present'
231 elif opt.result in ('FAIL: is off', 'FAIL: is off, "0"'):
232 self.result = f'FAIL: {opt.name} is off'
233 elif opt.result == 'FAIL: is off, not found':
234 self.result = f'FAIL: {opt.name} is off, not found'
236 # VersionCheck provides enough info
237 self.result = opt.result
238 assert(opt.result.startswith('FAIL: version')), \
239 f'unexpected FAIL description "{opt.result}"'
243 SIMPLE_OPTION_TYPES = ('kconfig', 'version', 'cmdline')
246 def populate_simple_opt_with_data(opt, data, data_type):
247 assert(opt.type != 'complex'), \
248 f'unexpected ComplexOptCheck "{opt.name}"'
249 assert(opt.type in SIMPLE_OPTION_TYPES), \
250 f'invalid opt type "{opt.type}"'
251 assert(data_type in SIMPLE_OPTION_TYPES), \
252 f'invalid data type "{data_type}"'
256 if data_type != opt.type:
259 if data_type in ('kconfig', 'cmdline'):
260 opt.state = data.get(opt.name, None)
262 assert(data_type == 'version'), \
263 f'unexpected data type "{data_type}"'
267 def populate_opt_with_data(opt, data, data_type):
268 if opt.type == 'complex':
270 if o.type == 'complex':
271 # Recursion for nested ComplexOptCheck objects
272 populate_opt_with_data(o, data, data_type)
274 populate_simple_opt_with_data(o, data, data_type)
276 assert(opt.type in ('kconfig', 'cmdline')), \
277 f'bad type "{opt.type}" for a simple check'
278 populate_simple_opt_with_data(opt, data, data_type)
281 def populate_with_data(checklist, data, data_type):
282 for opt in checklist:
283 populate_opt_with_data(opt, data, data_type)
286 def override_expected_value(checklist, name, new_val):
287 for opt in checklist:
289 assert(opt.type in ('kconfig', 'cmdline')), \
290 f'overriding an expected value for "{opt.type}" checks is not supported yet'
291 opt.expected = new_val
294 def perform_checks(checklist):
295 for opt in checklist: