if ver_pattern.match(line):
line = line.strip()
parts = line.split()
- ver_str = parts[2]
+ ver_str = parts[2].split('-', 1)[0]
ver_numbers = ver_str.split('.')
- if len(ver_numbers) < 3 or not ver_numbers[0].isdigit() or not ver_numbers[1].isdigit():
- msg = f'failed to parse the version "{ver_str}"'
- return None, msg
- return (int(ver_numbers[0]), int(ver_numbers[1])), None
+ if len(ver_numbers) >= 3:
+ if all(map(lambda x: x.isdigit(), ver_numbers)):
+ return tuple(map(int, ver_numbers)), None
+ msg = f'failed to parse the version "{parts[2]}"'
+ return None, msg
return None, 'no kernel version detected'
if gcc_version is None or clang_version is None:
return None, 'no CONFIG_GCC_VERSION or CONFIG_CLANG_VERSION'
if gcc_version == '0' and clang_version != '0':
- return 'CLANG ' + clang_version, 'OK'
+ return f'CLANG {clang_version}', 'OK'
if gcc_version != '0' and clang_version == '0':
- return 'GCC ' + gcc_version, 'OK'
+ return f'GCC {gcc_version}', 'OK'
sys.exit(f'[!] ERROR: invalid GCC_VERSION and CLANG_VERSION: {gcc_version} {clang_version}')
supported_archs = ['X86_64', 'X86_32', 'ARM64', 'ARM']
parser = ArgumentParser(prog='kernel-hardening-checker',
description='A tool for checking the security hardening options of the Linux kernel')
- parser.add_argument('--version', action='version', version='%(prog)s ' + __version__)
+ parser.add_argument('--version', action='version', version=f'%(prog)s {__version__}')
parser.add_argument('-m', '--mode', choices=report_modes,
help='choose the report mode')
parser.add_argument('-c', '--config',
print('[!] Hint: provide the kernel version file through --kernel-version option')
sys.exit(f'[!] ERROR: {msg}')
if mode != 'json':
- print(f'[+] Detected kernel version: {kernel_version[0]}.{kernel_version[1]}')
+ print(f'[+] Detected kernel version: {kernel_version}')
compiler, msg = detect_compiler(args.config)
if mode != 'json':
override_expected_value(config_checklist, 'CONFIG_ARCH_MMAP_RND_BITS', mmap_rnd_bits_max)
else:
# remove the CONFIG_ARCH_MMAP_RND_BITS check to avoid false results
- print('[-] Can\'t check CONFIG_ARCH_MMAP_RND_BITS without CONFIG_ARCH_MMAP_RND_BITS_MAX')
+ if mode != 'json':
+ print('[-] Can\'t check CONFIG_ARCH_MMAP_RND_BITS without CONFIG_ARCH_MMAP_RND_BITS_MAX')
config_checklist[:] = [o for o in config_checklist if o.name != 'CONFIG_ARCH_MMAP_RND_BITS']
# now everything is ready, perform the checks