Implement parse_sysctl_file()

[kconfig-hardened-check.git] / kconfig_hardened_check / __init__.py

diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py
index a423358b932d8dd3cb82a6e5c9c64259d856e3b7..143da1d92be3831da59402d63b4f4db4fea5d9fe 100644 (file)
--- a/kconfig_hardened_check/__init__.py
+++ b/kconfig_hardened_check/__init__.py
@@ -31,7 +31,7 @@ def _open(file: str, *args, **kwargs):
 
 def detect_arch(fname, archs):
     with _open(fname, 'rt', encoding='utf-8') as f:
-        arch_pattern = re.compile("CONFIG_[a-zA-Z0-9_]*=y")
+        arch_pattern = re.compile("CONFIG_[a-zA-Z0-9_]+=y$")
         arch = None
         for line in f.readlines():
             if arch_pattern.match(line):
@@ -40,7 +40,7 @@ def detect_arch(fname, archs):
                     if arch is None:
                         arch = option
                     else:
-                        return None, 'more than one supported microarchitecture is detected'
+                        return None, 'detected more than one microarchitecture'
         if arch is None:
             return None, 'failed to detect microarchitecture'
         return arch, 'OK'
@@ -48,7 +48,7 @@ def detect_arch(fname, archs):
 
 def detect_kernel_version(fname):
     with _open(fname, 'rt', encoding='utf-8') as f:
-        ver_pattern = re.compile("# Linux/.* Kernel Configuration")
+        ver_pattern = re.compile("# Linux/.+ Kernel Configuration$")
         for line in f.readlines():
             if ver_pattern.match(line):
                 line = line.strip()
@@ -66,12 +66,10 @@ def detect_compiler(fname):
     gcc_version = None
     clang_version = None
     with _open(fname, 'rt', encoding='utf-8') as f:
-        gcc_version_pattern = re.compile("CONFIG_GCC_VERSION=[0-9]*")
-        clang_version_pattern = re.compile("CONFIG_CLANG_VERSION=[0-9]*")
         for line in f.readlines():
-            if gcc_version_pattern.match(line):
+            if line.startswith('CONFIG_GCC_VERSION='):
                 gcc_version = line[19:-1]
-            if clang_version_pattern.match(line):
+            if line.startswith('CONFIG_CLANG_VERSION='):
                 clang_version = line[21:-1]
     if gcc_version is None or clang_version is None:
         return None, 'no CONFIG_GCC_VERSION or CONFIG_CLANG_VERSION'
@@ -154,8 +152,8 @@ def print_checklist(mode, checklist, with_results):
 
 def parse_kconfig_file(parsed_options, fname):
     with _open(fname, 'rt', encoding='utf-8') as f:
-        opt_is_on = re.compile("CONFIG_[a-zA-Z0-9_]*=[a-zA-Z0-9_\"]*")
-        opt_is_off = re.compile("# CONFIG_[a-zA-Z0-9_]* is not set")
+        opt_is_on = re.compile("CONFIG_[a-zA-Z0-9_]+=.+$")
+        opt_is_off = re.compile("# CONFIG_[a-zA-Z0-9_]+ is not set$")
 
         for line in f.readlines():
             line = line.strip()
@@ -168,8 +166,10 @@ def parse_kconfig_file(parsed_options, fname):
                     sys.exit(f'[!] ERROR: bad enabled Kconfig option "{line}"')
             elif opt_is_off.match(line):
                 option, value = line[2:].split(' ', 1)
-                if value != 'is not set':
-                    sys.exit(f'[!] ERROR: bad disabled Kconfig option "{line}"')
+                assert(value == 'is not set'), \
+                       f'unexpected value of disabled Kconfig option "{line}"'
+            elif line != '' and not line.startswith('#'):
+                print(f'[!] WARNING: strange line in Kconfig file: "{line}"')
 
             if option in parsed_options:
                 sys.exit(f'[!] ERROR: Kconfig option "{line}" exists multiple times')
@@ -193,12 +193,33 @@ def parse_cmdline_file(parsed_options, fname):
             else:
                 name = opt
                 value = '' # '' is not None
+            if name in parsed_options:
+                print(f'[!] WARNING: cmdline option "{name}" exists multiple times')
             value = normalize_cmdline_options(name, value)
             parsed_options[name] = value
 
 
 def parse_sysctl_file(parsed_options, fname):
-    print('parse_sysctl_file: TODO')
+    with open(fname, 'r', encoding='utf-8') as f:
+        sysctl_pattern = re.compile("[a-zA-Z0-9\._-]+ =.*$")
+        for line in f.readlines():
+            line = line.strip()
+            if not sysctl_pattern.match(line):
+                sys.exit(f'[!] ERROR: unexpected line in sysctl file: {line}')
+            option, value = line.split('=', 1)
+            option = option.strip()
+            value = value.strip()
+            # sysctl options may be found multiple times, let's save the last value:
+            parsed_options[option] = value
+
+    # let's check the presence of some ancient sysctl option
+    # to ensure that we are parsing the output of `sudo sysctl -a > file`
+    if 'kernel.printk' not in parsed_options:
+        sys.exit(f'[!] ERROR: {fname} doesn\'t look like a sysctl output file, please try `sudo sysctl -a > {fname}`')
+
+    # let's check the presence of a sysctl option available for root
+    if 'net.core.bpf_jit_harden' not in parsed_options:
+        print(f'[!] WARNING: sysctl option "net.core.bpf_jit_harden" available for root is not found in {fname}, please try `sudo sysctl -a > {fname}`')
 
 
 def main():