if ver_pattern.match(line):
line = line.strip()
parts = line.split()
- ver_str = parts[2]
+ ver_str = parts[2].split('-', 1)[0]
ver_numbers = ver_str.split('.')
- if len(ver_numbers) < 3 or not ver_numbers[0].isdigit() or not ver_numbers[1].isdigit():
- msg = f'failed to parse the version "{ver_str}"'
- return None, msg
- return (int(ver_numbers[0]), int(ver_numbers[1])), None
+ if len(ver_numbers) >= 3:
+ if all(map(lambda x: x.isdigit(), ver_numbers)):
+ return tuple(map(int, ver_numbers)), None
+ msg = f'failed to parse the version "{parts[2]}"'
+ return None, msg
return None, 'no kernel version detected'
if gcc_version is None or clang_version is None:
return None, 'no CONFIG_GCC_VERSION or CONFIG_CLANG_VERSION'
if gcc_version == '0' and clang_version != '0':
- return 'CLANG ' + clang_version, 'OK'
+ return f'CLANG {clang_version}', 'OK'
if gcc_version != '0' and clang_version == '0':
- return 'GCC ' + gcc_version, 'OK'
+ return f'GCC {gcc_version}', 'OK'
sys.exit(f'[!] ERROR: invalid GCC_VERSION and CLANG_VERSION: {gcc_version} {clang_version}')
known_options = []
for o1 in checklist:
- if o1.type != 'complex':
+ if o1.opt_type != 'complex':
known_options.append(o1.name)
continue
for o2 in o1.opts:
- if o2.type != 'complex':
+ if o2.opt_type != 'complex':
if hasattr(o2, 'name'):
known_options.append(o2.name)
continue
for o3 in o2.opts:
- assert(o3.type != 'complex'), \
+ assert(o3.opt_type != 'complex'), \
f'unexpected ComplexOptCheck inside {o2.name}'
if hasattr(o3, 'name'):
known_options.append(o3.name)
if with_results:
sep_line_len += 30
print('=' * sep_line_len)
- print(f'{"option name":^40}|{"type":^7}|{"desired val":^12}|{"decision":^10}|{"reason":^18}', end='')
+ print(f'{"option_name":^40}|{"type":^7}|{"desired_val":^12}|{"decision":^10}|{"reason":^18}', end='')
if with_results:
- print('| check result', end='')
+ print('| check_result', end='')
print()
print('=' * sep_line_len)
supported_archs = ['X86_64', 'X86_32', 'ARM64', 'ARM']
parser = ArgumentParser(prog='kernel-hardening-checker',
description='A tool for checking the security hardening options of the Linux kernel')
- parser.add_argument('--version', action='version', version='%(prog)s ' + __version__)
+ parser.add_argument('--version', action='version', version=f'%(prog)s {__version__}')
parser.add_argument('-m', '--mode', choices=report_modes,
help='choose the report mode')
parser.add_argument('-c', '--config',
print('[!] Hint: provide the kernel version file through --kernel-version option')
sys.exit(f'[!] ERROR: {msg}')
if mode != 'json':
- print(f'[+] Detected kernel version: {kernel_version[0]}.{kernel_version[1]}')
+ print(f'[+] Detected kernel version: {kernel_version}')
compiler, msg = detect_compiler(args.config)
if mode != 'json':
override_expected_value(config_checklist, 'CONFIG_ARCH_MMAP_RND_BITS', mmap_rnd_bits_max)
else:
# remove the CONFIG_ARCH_MMAP_RND_BITS check to avoid false results
- print('[-] Can\'t check CONFIG_ARCH_MMAP_RND_BITS without CONFIG_ARCH_MMAP_RND_BITS_MAX')
+ if mode != 'json':
+ print('[-] Can\'t check CONFIG_ARCH_MMAP_RND_BITS without CONFIG_ARCH_MMAP_RND_BITS_MAX')
config_checklist[:] = [o for o in config_checklist if o.name != 'CONFIG_ARCH_MMAP_RND_BITS']
# now everything is ready, perform the checks