projects
/
kconfig-hardened-check.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Merge remote-tracking branch 'origin/pylint'
[kconfig-hardened-check.git]
/
kernel_hardening_checker
/
checks.py
diff --git
a/kernel_hardening_checker/checks.py
b/kernel_hardening_checker/checks.py
index 193b374c8ae444628fec525e071134367b5228cb..f2e4c34fd6da0a81a046563329dd5e2736a09f46 100644
(file)
--- a/
kernel_hardening_checker/checks.py
+++ b/
kernel_hardening_checker/checks.py
@@
-8,13
+8,14
@@
Author: Alexander Popov <alex.popov@linux.com>
This module contains knowledge for checks.
"""
This module contains knowledge for checks.
"""
-# pylint: disable=missing-function-docstring,line-too-long
,invalid-name
+# pylint: disable=missing-function-docstring,line-too-long
# pylint: disable=too-many-branches,too-many-statements,too-many-locals
# pylint: disable=too-many-branches,too-many-statements,too-many-locals
-from .engine import KconfigCheck, CmdlineCheck, SysctlCheck, VersionCheck, OR, AND
+from typing import List
+from .engine import StrOrNone, ChecklistObjType, KconfigCheck, CmdlineCheck, SysctlCheck, VersionCheck, OR, AND
-def add_kconfig_checks(l
, arch: str)
:
+def add_kconfig_checks(l
: List[ChecklistObjType], arch: str) -> None
:
assert(arch), 'empty arch'
# Calling the KconfigCheck class constructor:
assert(arch), 'empty arch'
# Calling the KconfigCheck class constructor:
@@
-422,7
+423,7
@@
def add_kconfig_checks(l, arch: str):
l += [KconfigCheck('harden_userspace', 'a13xp0p0v', 'X86_USER_SHADOW_STACK', 'y')]
l += [KconfigCheck('harden_userspace', 'a13xp0p0v', 'X86_USER_SHADOW_STACK', 'y')]
-def add_cmdline_checks(l
, arch: str)
:
+def add_cmdline_checks(l
: List[ChecklistObjType], arch: str) -> None
:
assert(arch), 'empty arch'
# Calling the CmdlineCheck class constructor:
assert(arch), 'empty arch'
# Calling the CmdlineCheck class constructor:
@@
-646,7
+647,7
@@
def normalize_cmdline_options(option: str, value: str) -> str:
return value
return value
-#
TODO: draft
of security hardening sysctls:
+#
Ideas
of security hardening sysctls:
# what about bpf_jit_enable?
# vm.mmap_min_addr has a good value
# nosmt sysfs control file
# what about bpf_jit_enable?
# vm.mmap_min_addr has a good value
# nosmt sysfs control file
@@
-657,7
+658,7
@@
def normalize_cmdline_options(option: str, value: str) -> str:
# kernel.warn_limit (think about a proper value)
# net.ipv4.tcp_syncookies=1 (?)
# kernel.warn_limit (think about a proper value)
# net.ipv4.tcp_syncookies=1 (?)
-def add_sysctl_checks(l
, _arch: str)
:
+def add_sysctl_checks(l
: List[ChecklistObjType], _arch: StrOrNone) -> None
:
# This function may be called with arch=None
# Calling the SysctlCheck class constructor:
# This function may be called with arch=None
# Calling the SysctlCheck class constructor: