X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig-hardened-check.py;h=a7a7d9cf05df6b867ed03c1c5052590a3e8460dd;hb=refs%2Fpull%2F22%2Fhead;hp=9ca0279700ae1d9c4ce911f27f72f9e90c6a6519;hpb=a5535b23fad7cd21010c890bcb7322fc7abfe0c1;p=kconfig-hardened-check.git diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py index 9ca0279..a7a7d9c 100755 --- a/kconfig-hardened-check.py +++ b/kconfig-hardened-check.py @@ -40,13 +40,13 @@ import sys from argparse import ArgumentParser from collections import OrderedDict import re +import json debug_mode = False # set it to True to print the unknown options from the config +json_mode = False # if True, print results in JSON format supported_archs = [ 'X86_64', 'X86_32', 'ARM64', 'ARM' ] -checklist = [] - class OptCheck: def __init__(self, name, expected, decision, reason): @@ -148,7 +148,8 @@ def detect_arch(fname): arch_pattern = re.compile("CONFIG_[a-zA-Z0-9_]*=y") arch = None msg = None - print('[+] Trying to detect architecture in "{}"...'.format(fname)) + if not json_mode: + print('[+] Trying to detect architecture in "{}"...'.format(fname)) for line in f.readlines(): if arch_pattern.match(line): option, value = line[7:].split('=', 1) @@ -163,7 +164,7 @@ def detect_arch(fname): return arch, 'OK' -def construct_checklist(arch): +def construct_checklist(checklist, arch): modules_not_set = OptCheck('MODULES', 'is not set', 'kspp', 'cut_attack_surface') devmem_not_set = OptCheck('DEVMEM', 'is not set', 'kspp', 'cut_attack_surface') # refers to LOCK_DOWN_KERNEL @@ -373,24 +374,32 @@ def construct_checklist(arch): # checklist.append(OptCheck('LKDTM', 'm', 'my', 'feature_test')) -def print_checklist(arch): - print('[+] Printing kernel hardening preferences for {}...'.format(arch)) - print('{:^40}|{:^13}|{:^10}|{:^20}'.format( - 'option name', 'desired val', 'decision', 'reason')) - print('=' * 87) - for opt in checklist: - print('CONFIG_{:<33}|{:^13}|{:^10}|{:^20}'.format( - opt.name, opt.expected, opt.decision, opt.reason)) +def print_checklist(checklist, with_results): + if json_mode: + opts = [] + for o in checklist: + opt = ['CONFIG_'+o.name, o.expected, o.decision, o.reason] + if with_results: + opt.append(o.result) + opts.append(opt) + print(json.dumps(opts)) + return + + # header + print('{:^40}|{:^13}|{:^10}|{:^20}'.format('option name', 'desired val', 'decision', 'reason'), end='') + sep_line_len = 86 + if with_results: + print('||{:^28}'.format('check result'), end='') + sep_line_len += 30 print() + print('=' * sep_line_len) -def print_check_results(): - print('{:^40}|{:^13}|{:^10}|{:^20}||{:^28}'.format( - 'option name', 'desired val', 'decision', 'reason', 'check result')) - print('=' * 116) for opt in checklist: - print('CONFIG_{:<33}|{:^13}|{:^10}|{:^20}||{:^28}'.format( - opt.name, opt.expected, opt.decision, opt.reason, opt.result)) + print('CONFIG_{:<33}|{:^13}|{:^10}|{:^20}'.format(opt.name, opt.expected, opt.decision, opt.reason), end='') + if with_results: + print('||{:^28}'.format(opt.result), end='') + print() print() @@ -398,7 +407,7 @@ def get_option_state(options, name): return options.get(name, None) -def perform_checks(parsed_options): +def perform_checks(checklist, parsed_options): for opt in checklist: if hasattr(opt, 'opts'): for o in opt.opts: @@ -408,13 +417,14 @@ def perform_checks(parsed_options): opt.check() -def check_config_file(fname): +def check_config_file(checklist, fname): with open(fname, 'r') as f: parsed_options = OrderedDict() opt_is_on = re.compile("CONFIG_[a-zA-Z0-9_]*=[a-zA-Z0-9_\"]*") opt_is_off = re.compile("# CONFIG_[a-zA-Z0-9_]* is not set") - print('[+] Checking "{}" against hardening preferences...'.format(fname)) + if not json_mode: + print('[+] Checking "{}" against hardening preferences...'.format(fname)) for line in f.readlines(): line = line.strip() option = None @@ -433,7 +443,7 @@ def check_config_file(fname): if option is not None: parsed_options[option] = value - perform_checks(parsed_options) + perform_checks(checklist, parsed_options) if debug_mode: known_options = [opt.name for opt in checklist] @@ -441,10 +451,12 @@ def check_config_file(fname): if option not in known_options: print("DEBUG: dunno about option {} ({})".format(option, value)) - print_check_results() + print_checklist(checklist, True) if __name__ == '__main__': + config_checklist = [] + parser = ArgumentParser(description='Checks the hardening options in the Linux kernel config') parser.add_argument('-p', '--print', choices=supported_archs, help='print hardening preferences for selected architecture') @@ -452,31 +464,40 @@ if __name__ == '__main__': help='check the config_file against these preferences') parser.add_argument('--debug', action='store_true', help='enable internal debug mode') + parser.add_argument('--json', action='store_true', + help='print results in JSON format') args = parser.parse_args() if args.debug: debug_mode = True + if args.json: + json_mode = True + if debug_mode and json_mode: + sys.exit('[!] ERROR: options --debug and --json cannot be used simultaneously') if args.config: arch, msg = detect_arch(args.config) if not arch: sys.exit('[!] ERROR: {}'.format(msg)) - else: + elif not json_mode: print('[+] Detected architecture: {}'.format(arch)) - construct_checklist(arch) - check_config_file(args.config) - error_count = len(list(filter(lambda opt: opt.result.startswith('FAIL'), checklist))) - ok_count = len(list(filter(lambda opt: opt.result.startswith('OK'), checklist))) + construct_checklist(config_checklist, arch) + check_config_file(config_checklist, args.config) + error_count = len(list(filter(lambda opt: opt.result.startswith('FAIL'), config_checklist))) + ok_count = len(list(filter(lambda opt: opt.result.startswith('OK'), config_checklist))) if debug_mode: sys.exit(0) - print('[+] config check is finished: \'OK\' - {} / \'FAIL\' - {}'.format(ok_count, error_count)) + if not json_mode: + print('[+] config check is finished: \'OK\' - {} / \'FAIL\' - {}'.format(ok_count, error_count)) sys.exit(0) if args.print: arch = args.print - construct_checklist(arch) - print_checklist(arch) + construct_checklist(config_checklist, arch) + if not json_mode: + print('[+] Printing kernel hardening preferences for {}...'.format(arch)) + print_checklist(config_checklist, False) sys.exit(0) parser.print_help()