9 echo "Beginning of the functional tests"
11 echo ">>>>> get help <<<<<"
12 coverage run -a --branch bin/kconfig-hardened-check
13 coverage run -a --branch bin/kconfig-hardened-check -h
15 echo ">>>>> get version <<<<<"
16 coverage run -a --branch bin/kconfig-hardened-check --version
18 echo ">>>>> print the security hardening recommendations <<<<<"
19 coverage run -a --branch bin/kconfig-hardened-check -p X86_64
20 coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -m verbose
21 coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -m json
23 coverage run -a --branch bin/kconfig-hardened-check -p X86_32
24 coverage run -a --branch bin/kconfig-hardened-check -p X86_32 -m verbose
25 coverage run -a --branch bin/kconfig-hardened-check -p X86_32 -m json
27 coverage run -a --branch bin/kconfig-hardened-check -p ARM64
28 coverage run -a --branch bin/kconfig-hardened-check -p ARM64 -m verbose
29 coverage run -a --branch bin/kconfig-hardened-check -p ARM64 -m json
31 coverage run -a --branch bin/kconfig-hardened-check -p ARM
32 coverage run -a --branch bin/kconfig-hardened-check -p ARM -m verbose
33 coverage run -a --branch bin/kconfig-hardened-check -p ARM -m json
35 echo ">>>>> generate the Kconfig fragment <<<<<"
36 coverage run -a --branch bin/kconfig-hardened-check -g X86_64
37 coverage run -a --branch bin/kconfig-hardened-check -g X86_32
38 coverage run -a --branch bin/kconfig-hardened-check -g ARM64
39 coverage run -a --branch bin/kconfig-hardened-check -g ARM
41 echo ">>>>> check the example kconfig files, cmdline, and sysctl <<<<<"
43 echo "l1tf=off mds=full randomize_kstack_offset=on iommu.passthrough=0" > ./cmdline_example
45 sysctl -a > /tmp/sysctls
46 CONFIG_DIR=`find . -name config_files`
47 SYSCTL_EXAMPLE=$CONFIG_DIR/distros/example_sysctls.txt
48 KCONFIGS=`find $CONFIG_DIR -type f | grep -e "\.config" -e "\.gz"`
52 COUNT=$(expr $COUNT + 1)
53 echo "\n>>>>> checking kconfig number $COUNT <<<<<"
54 coverage run -a --branch bin/kconfig-hardened-check -c $C > /dev/null
55 coverage run -a --branch bin/kconfig-hardened-check -c $C -m verbose > /dev/null
56 coverage run -a --branch bin/kconfig-hardened-check -c $C -l /proc/cmdline > /dev/null
57 coverage run -a --branch bin/kconfig-hardened-check -c $C -s /tmp/sysctls > /dev/null
58 coverage run -a --branch bin/kconfig-hardened-check -c $C -l ./cmdline_example -s $SYSCTL_EXAMPLE > /dev/null
59 coverage run -a --branch bin/kconfig-hardened-check -c $C -l ./cmdline_example -s $SYSCTL_EXAMPLE -m verbose > /dev/null
60 coverage run -a --branch bin/kconfig-hardened-check -c $C -l ./cmdline_example -s $SYSCTL_EXAMPLE -m json > /dev/null
61 coverage run -a --branch bin/kconfig-hardened-check -c $C -l ./cmdline_example -s $SYSCTL_EXAMPLE -m show_ok > /dev/null
62 coverage run -a --branch bin/kconfig-hardened-check -c $C -l ./cmdline_example -s $SYSCTL_EXAMPLE -m show_fail > /dev/null
64 echo "\n>>>>> have checked $COUNT kconfigs <<<<<"
66 echo "Collect coverage for error handling"
68 echo ">>>>> -c and -p together <<<<<"
69 coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -c kconfig_hardened_check/config_files/distros/fedora_34.config && exit 1
71 echo ">>>>> -c and -g together <<<<<"
72 coverage run -a --branch bin/kconfig-hardened-check -g X86_64 -c kconfig_hardened_check/config_files/distros/fedora_34.config && exit 1
74 echo ">>>>> -p and -g together <<<<<"
75 coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -g X86_64 && exit 1
77 echo ">>>>> -l without -c <<<<<"
78 coverage run -a --branch bin/kconfig-hardened-check -l /proc/cmdline && exit 1
80 echo ">>>>> wrong modes for -p <<<<<"
81 coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -m show_ok && exit 1
82 coverage run -a --branch bin/kconfig-hardened-check -p X86_64 -m show_fail && exit 1
84 echo ">>>>> wrong mode for -g <<<<<"
85 coverage run -a --branch bin/kconfig-hardened-check -g X86_64 -m show_ok && exit 1
87 cp kconfig_hardened_check/config_files/distros/fedora_34.config ./test.config
89 echo ">>>>> no kernel version <<<<<"
90 sed '3d' test.config > error.config
91 coverage run -a --branch bin/kconfig-hardened-check -c error.config && exit 1
93 echo ">>>>> strange kernel version string <<<<<"
94 sed '3 s/5./version 5./' test.config > error.config
95 coverage run -a --branch bin/kconfig-hardened-check -c error.config && exit 1
97 echo ">>>>> no arch <<<<<"
98 sed '305d' test.config > error.config
99 coverage run -a --branch bin/kconfig-hardened-check -c error.config && exit 1
101 echo ">>>>> more than one arch <<<<<"
102 cp test.config error.config
103 echo 'CONFIG_ARM64=y' >> error.config
104 coverage run -a --branch bin/kconfig-hardened-check -c error.config && exit 1
106 echo ">>>>> invalid enabled kconfig option <<<<<"
107 cp test.config error.config
108 echo 'CONFIG_FOO=is not set' >> error.config
109 coverage run -a --branch bin/kconfig-hardened-check -c error.config && exit 1
111 echo ">>>>> one config option multiple times <<<<<"
112 cp test.config error.config
113 echo 'CONFIG_BUG=y' >> error.config
114 coverage run -a --branch bin/kconfig-hardened-check -c error.config && exit 1
116 echo ">>>>> invalid compiler versions <<<<<"
117 cp test.config error.config
118 sed '8 s/CONFIG_CLANG_VERSION=0/CONFIG_CLANG_VERSION=120000/' test.config > error.config
119 coverage run -a --branch bin/kconfig-hardened-check -c error.config && exit 1
121 echo ">>>>> unexpected line in the kconfig file <<<<<"
122 cp test.config error.config
123 echo 'some strange line' >> error.config
124 coverage run -a --branch bin/kconfig-hardened-check -c error.config && exit 1
126 echo ">>>>> multi-line cmdline file <<<<<"
127 echo 'hey man 1' > cmdline
128 echo 'hey man 2' >> cmdline
129 coverage run -a --branch bin/kconfig-hardened-check -c test.config -l cmdline && exit 1
131 echo ">>>>> unexpected line in the sysctl file <<<<<"
132 cp $SYSCTL_EXAMPLE error_sysctls
133 echo 'some strange line' >> error_sysctls
134 coverage run -a --branch bin/kconfig-hardened-check -c test.config -s error_sysctls && exit 1
136 echo ">>>>> invalid sysctl file <<<<<"
138 coverage run -a --branch bin/kconfig-hardened-check -c test.config -s empty_file && exit 1
140 echo "The end of the functional tests"