X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig_hardened_check%2F__init__.py;h=0367d88094b22ea8e779e2146841ed7dd18270b0;hb=e9fa43330ce69e7b532c845b01ec61d626ed206a;hp=d3cbad160280568c90b8a51d04ce338c0048c35b;hpb=80d998f6a81715f020ea3032848d1f834ed2c730;p=kconfig-hardened-check.git diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index d3cbad1..0367d88 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -11,24 +11,17 @@ # # # N.B Hardening command line parameters: -# slab_nomerge # page_alloc.shuffle=1 # iommu=force (does it help against DMA attacks?) -# iommu.passthrough=0 -# iommu.strict=1 # slub_debug=FZ (slow) -# init_on_alloc=1 (since v5.3) -# init_on_free=1 (since v5.3, otherwise slub_debug=P and page_poison=1) # loadpin.enforce=1 # debugfs=no-mount (or off if possible) -# randomize_kstack_offset=1 # # Mitigations of CPU vulnerabilities: # Аrch-independent: # mitigations=auto,nosmt (nosmt is slow) # X86: # spectre_v2=on -# pti=on # spec_store_bypass_disable=on # l1tf=full,force # l1d_flush=on (a part of the l1tf option) @@ -40,8 +33,10 @@ # # Should NOT be set: # nokaslr +# sysrq_always_enabled # arm64.nobti # arm64.nopauth +# arm64.nomte # # Hardware tag-based KASAN with arm64 Memory Tagging Extension (MTE): # kasan=on @@ -58,11 +53,10 @@ # what about bpf_jit_enable? # kernel.unprivileged_bpf_disabled=1 # net.core.bpf_jit_harden=2 -# # vm.unprivileged_userfaultfd=0 # (at first, it disabled unprivileged userfaultfd, # and since v5.11 it enables unprivileged userfaultfd for user-mode only) -# +# vm.mmap_min_addr has a good value # dev.tty.ldisc_autoload=0 # fs.protected_symlinks=1 # fs.protected_hardlinks=1 @@ -70,6 +64,7 @@ # fs.protected_regular=2 # fs.suid_dumpable=0 # kernel.modules_disabled=1 +# kernel.randomize_va_space = 2 # pylint: disable=missing-module-docstring,missing-class-docstring,missing-function-docstring @@ -83,13 +78,13 @@ import re import json from .__about__ import __version__ -TYPES_OF_CHECKS = ('kconfig', 'version') +SIMPLE_OPTION_TYPES = ('kconfig', 'version', 'cmdline') class OptCheck: # Constructor without the 'expected' parameter is for option presence checks (any value is OK) def __init__(self, reason, decision, name, expected=None): - if not reason or not decision or not name: - sys.exit('[!] ERROR: invalid {} check for "{}"'.format(self.__class__.__name__, name)) + assert(reason and decision and name), \ + 'invalid {} check for "{}"'.format(self.__class__.__name__, name) self.name = name self.expected = expected self.decision = decision @@ -130,6 +125,12 @@ class OptCheck: if with_results: print('| {}'.format(self.result), end='') + def json_dump(self, with_results): + dump = [self.name, self.type, self.expected, self.decision, self.reason] + if with_results: + dump.append(self.result) + return dump + class KconfigCheck(OptCheck): def __init__(self, *args, **kwargs): @@ -140,11 +141,11 @@ class KconfigCheck(OptCheck): def type(self): return 'kconfig' - def json_dump(self, with_results): - dump = [self.name, self.type, self.expected, self.decision, self.reason] - if with_results: - dump.append(self.result) - return dump + +class CmdlineCheck(OptCheck): + @property + def type(self): + return 'cmdline' class VersionCheck: @@ -179,33 +180,25 @@ class VersionCheck: class ComplexOptCheck: def __init__(self, *opts): self.opts = opts - if not self.opts: - sys.exit('[!] ERROR: empty {} check'.format(self.__class__.__name__)) - if len(self.opts) == 1: - sys.exit('[!] ERROR: useless {} check'.format(self.__class__.__name__)) - if not isinstance(opts[0], KconfigCheck): - sys.exit('[!] ERROR: invalid {} check: {}'.format(self.__class__.__name__, opts)) + assert(self.opts), \ + 'empty {} check'.format(self.__class__.__name__) + assert(len(self.opts) != 1), \ + 'useless {} check: {}'.format(self.__class__.__name__, opts) + assert(isinstance(opts[0], (KconfigCheck, CmdlineCheck))), \ + 'invalid {} check: {}'.format(self.__class__.__name__, opts) self.result = None - @property - def name(self): - return self.opts[0].name - @property def type(self): return 'complex' @property - def expected(self): - return self.opts[0].expected - - @property - def decision(self): - return self.opts[0].decision + def name(self): + return self.opts[0].name @property - def reason(self): - return self.opts[0].reason + def expected(self): + return self.opts[0].expected def table_print(self, mode, with_results): if mode == 'verbose': @@ -234,8 +227,6 @@ class OR(ComplexOptCheck): # OR(, ) # OR(, ) def check(self): - if not self.opts: - sys.exit('[!] ERROR: invalid OR check') for i, opt in enumerate(self.opts): opt.check() if opt.result.startswith('OK'): @@ -248,9 +239,10 @@ class OR(ComplexOptCheck): self.result = 'OK: {} not found'.format(opt.name) elif opt.result == 'OK: is present': self.result = 'OK: {} is present'.format(opt.name) - # VersionCheck provides enough info - elif not opt.result.startswith('OK: version'): - sys.exit('[!] ERROR: unexpected OK description "{}"'.format(opt.result)) + else: + # VersionCheck provides enough info + assert(opt.result.startswith('OK: version')), \ + 'unexpected OK description "{}"'.format(opt.result) return self.result = self.opts[0].result @@ -278,10 +270,9 @@ class AND(ComplexOptCheck): else: # VersionCheck provides enough info self.result = opt.result - if not opt.result.startswith('FAIL: version'): - sys.exit('[!] ERROR: unexpected FAIL description "{}"'.format(opt.result)) + assert(opt.result.startswith('FAIL: version')), \ + 'unexpected FAIL description "{}"'.format(opt.result) return - sys.exit('[!] ERROR: invalid AND check') def detect_arch(fname, archs): @@ -320,6 +311,9 @@ def detect_version(fname): def add_kconfig_checks(l, arch): # Calling the KconfigCheck class constructor: # KconfigCheck(reason, decision, name, expected) + # + # [!] Don't add CmdlineChecks in add_kconfig_checks() to avoid wrong results + # when the tool doesn't check the cmdline. modules_not_set = KconfigCheck('cut_attack_surface', 'kspp', 'MODULES', 'is not set') devmem_not_set = KconfigCheck('cut_attack_surface', 'kspp', 'DEVMEM', 'is not set') # refers to LOCKDOWN @@ -331,7 +325,10 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('self_protection', 'defconfig', 'SLUB_DEBUG', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'GCC_PLUGINS', 'y')] l += [OR(KconfigCheck('self_protection', 'defconfig', 'STACKPROTECTOR', 'y'), - KconfigCheck('self_protection', 'defconfig', 'CC_STACKPROTECTOR', 'y'))] + KconfigCheck('self_protection', 'defconfig', 'CC_STACKPROTECTOR', 'y'), + KconfigCheck('self_protection', 'defconfig', 'CC_STACKPROTECTOR_REGULAR', 'y'), + KconfigCheck('self_protection', 'defconfig', 'CC_STACKPROTECTOR_AUTO', 'y'), + KconfigCheck('self_protection', 'defconfig', 'CC_STACKPROTECTOR_STRONG', 'y'))] l += [OR(KconfigCheck('self_protection', 'defconfig', 'STACKPROTECTOR_STRONG', 'y'), KconfigCheck('self_protection', 'defconfig', 'CC_STACKPROTECTOR_STRONG', 'y'))] l += [OR(KconfigCheck('self_protection', 'defconfig', 'STRICT_KERNEL_RWX', 'y'), @@ -378,13 +375,13 @@ def add_kconfig_checks(l, arch): VersionCheck((5, 10)))] # HARDEN_BRANCH_PREDICTOR is enabled by default since v5.10 l += [KconfigCheck('self_protection', 'defconfig', 'MITIGATE_SPECTRE_BRANCH_HISTORY', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'ARM64_MTE', 'y')] + l += [KconfigCheck('self_protection', 'defconfig', 'RANDOMIZE_MODULE_REGION_FULL', 'y')] if arch == 'ARM': l += [KconfigCheck('self_protection', 'defconfig', 'CPU_SW_DOMAIN_PAN', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'HARDEN_BRANCH_PREDICTOR', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'HARDEN_BRANCH_HISTORY', 'y')] # 'self_protection', 'kspp' - l += [KconfigCheck('self_protection', 'kspp', 'SECURITY_DMESG_RESTRICT', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'BUG_ON_DATA_CORRUPTION', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'DEBUG_WX', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'SCHED_STACK_END_CHECK', 'y')] @@ -401,6 +398,7 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('self_protection', 'kspp', 'KFENCE', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'WERROR', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_DMA_STRICT', 'y')] + l += [KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_PASSTHROUGH', 'is not set')] # true if IOMMU_DEFAULT_DMA_STRICT is set l += [KconfigCheck('self_protection', 'kspp', 'ZERO_CALL_USED_REGS', 'y')] randstruct_is_set = KconfigCheck('self_protection', 'kspp', 'GCC_PLUGIN_RANDSTRUCT', 'y') l += [randstruct_is_set] @@ -458,7 +456,7 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('self_protection', 'clipos', 'STATIC_USERMODEHELPER', 'y')] # needs userspace support l += [OR(KconfigCheck('self_protection', 'clipos', 'EFI_DISABLE_PCI_DMA', 'y'), efi_not_set)] - l += [KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set')] # slab_nomerge + l += [KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set')] l += [KconfigCheck('self_protection', 'clipos', 'RANDOM_TRUST_BOOTLOADER', 'is not set')] l += [KconfigCheck('self_protection', 'clipos', 'RANDOM_TRUST_CPU', 'is not set')] l += [AND(KconfigCheck('self_protection', 'clipos', 'GCC_PLUGIN_RANDSTRUCT_PERFORMANCE', 'is not set'), @@ -520,6 +518,7 @@ def add_kconfig_checks(l, arch): devmem_not_set)] # refers to LOCKDOWN # 'cut_attack_surface', 'kspp' + l += [KconfigCheck('cut_attack_surface', 'kspp', 'SECURITY_DMESG_RESTRICT', 'y')] l += [KconfigCheck('cut_attack_surface', 'kspp', 'ACPI_CUSTOM_METHOD', 'is not set')] # refers to LOCKDOWN l += [KconfigCheck('cut_attack_surface', 'kspp', 'COMPAT_BRK', 'is not set')] l += [KconfigCheck('cut_attack_surface', 'kspp', 'DEVKMEM', 'is not set')] # refers to LOCKDOWN @@ -630,12 +629,16 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('cut_attack_surface', 'my', 'FTRACE', 'is not set')] # refers to LOCKDOWN l += [KconfigCheck('cut_attack_surface', 'my', 'VIDEO_VIVID', 'is not set')] l += [KconfigCheck('cut_attack_surface', 'my', 'INPUT_EVBUG', 'is not set')] # Can be used as a keylogger + l += [KconfigCheck('cut_attack_surface', 'my', 'KGDB', 'is not set')] # 'harden_userspace' if arch in ('X86_64', 'ARM64', 'X86_32'): l += [KconfigCheck('harden_userspace', 'defconfig', 'INTEGRITY', 'y')] if arch == 'ARM': l += [KconfigCheck('harden_userspace', 'my', 'INTEGRITY', 'y')] + if arch == 'ARM64': + l += [KconfigCheck('harden_userspace', 'defconfig', 'ARM64_PTR_AUTH', 'y')] + l += [KconfigCheck('harden_userspace', 'defconfig', 'ARM64_BTI', 'y')] if arch in ('ARM', 'X86_32'): l += [KconfigCheck('harden_userspace', 'defconfig', 'VMSPLIT_3G', 'y')] if arch in ('X86_64', 'ARM64'): @@ -643,7 +646,72 @@ def add_kconfig_checks(l, arch): if arch in ('X86_32', 'ARM'): l += [KconfigCheck('harden_userspace', 'my', 'ARCH_MMAP_RND_BITS', '16')] -# l += [KconfigCheck('feature_test', 'my', 'LKDTM', 'm')] # only for debugging! + +def add_cmdline_checks(l, arch): + # Calling the CmdlineCheck class constructor: + # CmdlineCheck(reason, decision, name, expected) + # + # [!] Don't add CmdlineChecks in add_kconfig_checks() to avoid wrong results + # when the tool doesn't check the cmdline. + # + # [!] Make sure that values of the options in CmdlineChecks need normalization. + # For more info see normalize_cmdline_options(). + # + # A common pattern for checking the 'param_x' cmdline parameter + # that __overrides__ the 'PARAM_X_DEFAULT' kconfig option: + # l += [OR(CmdlineCheck(reason, decision, 'param_x', '1'), + # AND(KconfigCheck(reason, decision, 'PARAM_X_DEFAULT_ON', 'y'), + # CmdlineCheck(reason, decision, 'param_x, 'is not set')))] + # + # Here we don't check the kconfig options or minimal kernel version + # required for the cmdline parameters. That would make the checks + # very complex and not give a 100% guarantee anyway. + + if arch == 'ARM64': + l += [OR(CmdlineCheck('self_protection', 'defconfig', 'rodata', 'full'), + AND(KconfigCheck('self_protection', 'defconfig', 'RODATA_FULL_DEFAULT_ENABLED', 'y'), + CmdlineCheck('self_protection', 'defconfig', 'rodata', 'is not set')))] + else: + l += [OR(CmdlineCheck('self_protection', 'defconfig', 'rodata', '1'), + CmdlineCheck('self_protection', 'defconfig', 'rodata', 'is not set'))] + + l += [OR(CmdlineCheck('self_protection', 'kspp', 'init_on_alloc', '1'), + AND(KconfigCheck('self_protection', 'kspp', 'INIT_ON_ALLOC_DEFAULT_ON', 'y'), + CmdlineCheck('self_protection', 'kspp', 'init_on_alloc', 'is not set')))] + l += [OR(CmdlineCheck('self_protection', 'kspp', 'init_on_free', '1'), + AND(KconfigCheck('self_protection', 'kspp', 'INIT_ON_FREE_DEFAULT_ON', 'y'), + CmdlineCheck('self_protection', 'kspp', 'init_on_free', 'is not set')), + AND(CmdlineCheck('self_protection', 'kspp', 'page_poison', '1'), + KconfigCheck('self_protection', 'kspp', 'PAGE_POISONING_ZERO', 'y'), + CmdlineCheck('self_protection', 'kspp', 'slub_debug', 'P')))] + l += [OR(CmdlineCheck('self_protection', 'kspp', 'slab_nomerge'), + AND(KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set'), + CmdlineCheck('self_protection', 'kspp', 'slab_merge', 'is not set')))] # option presence check + l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.strict', '1'), + AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_DMA_STRICT', 'y'), + CmdlineCheck('self_protection', 'kspp', 'iommu.strict', 'is not set')))] + l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', '0'), + AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_PASSTHROUGH', 'is not set'), + CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', 'is not set')))] + l += [OR(CmdlineCheck('self_protection', 'kspp', 'hardened_usercopy', '1'), + AND(KconfigCheck('self_protection', 'kspp', 'HARDENED_USERCOPY', 'y'), + CmdlineCheck('self_protection', 'kspp', 'hardened_usercopy', 'is not set')))] + l += [OR(CmdlineCheck('self_protection', 'kspp', 'slab_common.usercopy_fallback', '0'), + AND(KconfigCheck('self_protection', 'kspp', 'HARDENED_USERCOPY_FALLBACK', 'is not set'), + CmdlineCheck('self_protection', 'kspp', 'slab_common.usercopy_fallback', 'is not set')))] + if arch in ('X86_64', 'ARM64', 'X86_32'): + l += [OR(CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', '1'), + AND(KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y'), + CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', 'is not set')))] + if arch in ('X86_64', 'X86_32'): + l += [CmdlineCheck('self_protection', 'kspp', 'pti', 'on')] + + if arch == 'X86_64': + l += [OR(CmdlineCheck('cut_attack_surface', 'kspp', 'vsyscall', 'none'), + AND(KconfigCheck('cut_attack_surface', 'kspp', 'LEGACY_VSYSCALL_NONE', 'y'), + CmdlineCheck('cut_attack_surface', 'kspp', 'vsyscall', 'is not set')))] + + # TODO: add other def print_unknown_options(checklist, parsed_options): @@ -659,8 +727,8 @@ def print_unknown_options(checklist, parsed_options): known_options.append(o2.name) continue for o3 in o2.opts: - if o3.type == 'complex': - sys.exit('[!] ERROR: unexpected ComplexOptCheck inside {}'.format(o2.name)) + assert(o3.type != 'complex'), \ + 'unexpected ComplexOptCheck inside {}'.format(o2.name) if hasattr(o3, 'name'): known_options.append(o3.name) @@ -718,22 +786,22 @@ def print_checklist(mode, checklist, with_results): def populate_simple_opt_with_data(opt, data, data_type): - if opt.type == 'complex': - sys.exit('[!] ERROR: unexpected ComplexOptCheck {}: {}'.format(opt.name, vars(opt))) - if opt.type not in TYPES_OF_CHECKS: - sys.exit('[!] ERROR: invalid opt type "{}" for {}'.format(opt.type, opt.name)) - if data_type not in TYPES_OF_CHECKS: - sys.exit('[!] ERROR: invalid data type "{}"'.format(data_type)) + assert(opt.type != 'complex'), \ + 'unexpected ComplexOptCheck "{}"'.format(opt.name) + assert(opt.type in SIMPLE_OPTION_TYPES), \ + 'invalid opt type "{}"'.format(opt.type) + assert(data_type in SIMPLE_OPTION_TYPES), \ + 'invalid data type "{}"'.format(data_type) if data_type != opt.type: return - if data_type == 'kconfig': + if data_type in ('kconfig', 'cmdline'): opt.state = data.get(opt.name, None) - elif data_type == 'version': - opt.ver = data else: - sys.exit('[!] ERROR: unexpected data type "{}"'.format(data_type)) + assert(data_type == 'version'), \ + 'unexpected data type "{}"'.format(data_type) + opt.ver = data def populate_opt_with_data(opt, data, data_type): @@ -745,8 +813,8 @@ def populate_opt_with_data(opt, data, data_type): else: populate_simple_opt_with_data(o, data, data_type) else: - if opt.type != 'kconfig': - sys.exit('[!] ERROR: bad type "{}" for a simple check {}'.format(opt.type, opt.name)) + assert(opt.type in ('kconfig', 'cmdline')), \ + 'bad type "{}" for a simple check'.format(opt.type) populate_simple_opt_with_data(opt, data, data_type) @@ -772,6 +840,8 @@ def parse_kconfig_file(parsed_options, fname): if opt_is_on.match(line): option, value = line.split('=', 1) + if value == 'is not set': + sys.exit('[!] ERROR: bad enabled kconfig option "{}"'.format(line)) elif opt_is_off.match(line): option, value = line[2:].split(' ', 1) if value != 'is not set': @@ -784,6 +854,43 @@ def parse_kconfig_file(parsed_options, fname): parsed_options[option] = value +def normalize_cmdline_options(option, value): + # Handle special cases + if option == 'pti': + # Don't normalize the pti value since + # the Linux kernel doesn't use kstrtobool() for pti. + # See pti_check_boottime_disable() in linux/arch/x86/mm/pti.c + return value + + # Implement a limited part of the kstrtobool() logic + if value in ('1', 'on', 'On', 'ON', 'y', 'Y', 'yes', 'Yes', 'YES'): + return '1' + if value in ('0', 'off', 'Off', 'OFF', 'n', 'N', 'no', 'No', 'NO'): + return '0' + + # Preserve unique values + return value + + +def parse_cmdline_file(parsed_options, fname): + with open(fname, 'r') as f: + line = f.readline() + opts = line.split() + + line = f.readline() + if line: + sys.exit('[!] ERROR: more than one line in "{}"'.format(fname)) + + for opt in opts: + if '=' in opt: + name, value = opt.split('=', 1) + else: + name = opt + value = '' # '' is not None + value = normalize_cmdline_options(name, value) + parsed_options[name] = value + + def main(): # Report modes: # * verbose mode for @@ -799,6 +906,8 @@ def main(): help='print security hardening preferences for the selected architecture') parser.add_argument('-c', '--config', help='check the kernel kconfig file against these preferences') + parser.add_argument('-l', '--cmdline', + help='check the kernel cmdline file against these preferences') parser.add_argument('-m', '--mode', choices=report_modes, help='choose the report mode') args = parser.parse_args() @@ -812,8 +921,13 @@ def main(): config_checklist = [] if args.config: + if args.print: + sys.exit('[!] ERROR: --config and --print can\'t be used together') + if mode != 'json': print('[+] Kconfig file to check: {}'.format(args.config)) + if args.cmdline: + print('[+] Kernel cmdline file to check: {}'.format(args.cmdline)) arch, msg = detect_arch(args.config, supported_archs) if not arch: @@ -830,12 +944,22 @@ def main(): # add relevant kconfig checks to the checklist add_kconfig_checks(config_checklist, arch) + if args.cmdline: + # add relevant cmdline checks to the checklist + add_cmdline_checks(config_checklist, arch) + # populate the checklist with the parsed kconfig data parsed_kconfig_options = OrderedDict() parse_kconfig_file(parsed_kconfig_options, args.config) populate_with_data(config_checklist, parsed_kconfig_options, 'kconfig') populate_with_data(config_checklist, kernel_version, 'version') + if args.cmdline: + # populate the checklist with the parsed kconfig data + parsed_cmdline_options = OrderedDict() + parse_cmdline_file(parsed_cmdline_options, args.cmdline) + populate_with_data(config_checklist, parsed_cmdline_options, 'cmdline') + # now everything is ready for performing the checks perform_checks(config_checklist) @@ -845,12 +969,15 @@ def main(): print_checklist(mode, config_checklist, True) sys.exit(0) + elif args.cmdline: + sys.exit('[!] ERROR: checking cmdline doesn\'t work without checking kconfig') if args.print: if mode in ('show_ok', 'show_fail'): sys.exit('[!] ERROR: wrong mode "{}" for --print'.format(mode)) arch = args.print add_kconfig_checks(config_checklist, arch) + add_cmdline_checks(config_checklist, arch) if mode != 'json': print('[+] Printing kernel security hardening preferences for {}...'.format(arch)) print_checklist(mode, config_checklist, False) @@ -858,6 +985,3 @@ def main(): parser.print_help() sys.exit(0) - -if __name__ == '__main__': - main()