if opt_is_on.match(line):
option, value = line.split('=', 1)
if value == 'is not set':
if opt_is_on.match(line):
option, value = line.split('=', 1)
if value == 'is not set':
elif opt_is_off.match(line):
option, value = line[2:].split(' ', 1)
if value != 'is not set':
elif opt_is_off.match(line):
option, value = line[2:].split(' ', 1)
if value != 'is not set':
# - verbose printing of ComplexOptCheck items
# * json mode for printing the results in JSON format
report_modes = ['verbose', 'json', 'show_ok', 'show_fail']
# - verbose printing of ComplexOptCheck items
# * json mode for printing the results in JSON format
report_modes = ['verbose', 'json', 'show_ok', 'show_fail']
parser = ArgumentParser(prog='kconfig-hardened-check',
description='A tool for checking the security hardening options of the Linux kernel')
parser.add_argument('--version', action='version', version='%(prog)s ' + __version__)
parser = ArgumentParser(prog='kconfig-hardened-check',
description='A tool for checking the security hardening options of the Linux kernel')
parser.add_argument('--version', action='version', version='%(prog)s ' + __version__)
- parser.add_argument('-p', '--print', choices=supported_archs,
- help='print the security hardening recommendations for the selected microarchitecture')
+ parser.add_argument('-m', '--mode', choices=report_modes,
+ help='choose the report mode')
parser.add_argument('-l', '--cmdline',
help='check the security hardening options in the kernel cmdline file')
parser.add_argument('-l', '--cmdline',
help='check the security hardening options in the kernel cmdline file')
- parser.add_argument('-m', '--mode', choices=report_modes,
- help='choose the report mode')
+ parser.add_argument('-p', '--print', choices=supported_archs,
+ help='print the security hardening recommendations for the selected microarchitecture')
add_kconfig_checks(config_checklist, arch)
if args.cmdline:
# add relevant cmdline checks to the checklist
add_cmdline_checks(config_checklist, arch)
add_kconfig_checks(config_checklist, arch)
if args.cmdline:
# add relevant cmdline checks to the checklist
add_cmdline_checks(config_checklist, arch)
parsed_kconfig_options = OrderedDict()
parse_kconfig_file(parsed_kconfig_options, args.config)
populate_with_data(config_checklist, parsed_kconfig_options, 'kconfig')
parsed_kconfig_options = OrderedDict()
parse_kconfig_file(parsed_kconfig_options, args.config)
populate_with_data(config_checklist, parsed_kconfig_options, 'kconfig')
- if mode in ('show_ok', 'show_fail'):
+ assert(args.config is None and args.cmdline is None), 'unexpected args'
+ if mode and mode not in ('verbose', 'json'):
sys.exit(f'[!] ERROR: wrong mode "{mode}" for --print')
arch = args.print
add_kconfig_checks(config_checklist, arch)
sys.exit(f'[!] ERROR: wrong mode "{mode}" for --print')
arch = args.print
add_kconfig_checks(config_checklist, arch)