if file.endswith('.gz'):
open_method = gzip.open
- return open_method(file, *args, **kwargs)
+ try:
+ return open_method(file, *args, **kwargs)
+ except FileNotFoundError:
+ sys.exit(f'[!] ERROR: unable to open {file}, are you sure it exists?')
+
def detect_arch(fname, archs):
if ver_pattern.match(line):
line = line.strip()
parts = line.split()
- ver_str = parts[2]
+ ver_str = parts[2].split('-', 1)[0]
ver_numbers = ver_str.split('.')
- if len(ver_numbers) < 3 or not ver_numbers[0].isdigit() or not ver_numbers[1].isdigit():
- msg = f'failed to parse the version "{ver_str}"'
- return None, msg
- return (int(ver_numbers[0]), int(ver_numbers[1])), None
+ if len(ver_numbers) >= 3:
+ if all(map(lambda x: x.isdigit(), ver_numbers)):
+ return tuple(map(int, ver_numbers)), None
+ msg = f'failed to parse the version "{parts[2]}"'
+ return None, msg
return None, 'no kernel version detected'
known_options = []
for o1 in checklist:
- if o1.type != 'complex':
+ if o1.opt_type != 'complex':
known_options.append(o1.name)
continue
for o2 in o1.opts:
- if o2.type != 'complex':
+ if o2.opt_type != 'complex':
if hasattr(o2, 'name'):
known_options.append(o2.name)
continue
for o3 in o2.opts:
- assert(o3.type != 'complex'), \
+ assert(o3.opt_type != 'complex'), \
f'unexpected ComplexOptCheck inside {o2.name}'
if hasattr(o3, 'name'):
known_options.append(o3.name)
if with_results:
sep_line_len += 30
print('=' * sep_line_len)
- print(f'{"option name":^40}|{"type":^7}|{"desired val":^12}|{"decision":^10}|{"reason":^18}', end='')
+ print(f'{"option_name":^40}|{"type":^7}|{"desired_val":^12}|{"decision":^10}|{"reason":^18}', end='')
if with_results:
- print('| check result', end='')
+ print('| check_result', end='')
print()
print('=' * sep_line_len)
sys.exit(f'[!] ERROR: {fname} doesn\'t look like a sysctl output file, please try `sudo sysctl -a > {fname}`')
# let's check the presence of a sysctl option available for root
- if 'net.core.bpf_jit_harden' not in parsed_options and mode != 'json':
- print(f'[!] WARNING: sysctl option "net.core.bpf_jit_harden" available for root is not found in {fname}, please try `sudo sysctl -a > {fname}`')
+ if 'kernel.cad_pid' not in parsed_options and mode != 'json':
+ print(f'[!] WARNING: sysctl option "kernel.cad_pid" available for root is not found in {fname}, please try `sudo sysctl -a > {fname}`')
def main():
print('[!] Hint: provide the kernel version file through --kernel-version option')
sys.exit(f'[!] ERROR: {msg}')
if mode != 'json':
- print(f'[+] Detected kernel version: {kernel_version[0]}.{kernel_version[1]}')
+ print(f'[+] Detected kernel version: {kernel_version}')
compiler, msg = detect_compiler(args.config)
if mode != 'json':
override_expected_value(config_checklist, 'CONFIG_ARCH_MMAP_RND_BITS', mmap_rnd_bits_max)
else:
# remove the CONFIG_ARCH_MMAP_RND_BITS check to avoid false results
- print('[-] Can\'t check CONFIG_ARCH_MMAP_RND_BITS without CONFIG_ARCH_MMAP_RND_BITS_MAX')
+ if mode != 'json':
+ print('[-] Can\'t check CONFIG_ARCH_MMAP_RND_BITS without CONFIG_ARCH_MMAP_RND_BITS_MAX')
config_checklist[:] = [o for o in config_checklist if o.name != 'CONFIG_ARCH_MMAP_RND_BITS']
# now everything is ready, perform the checks