X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig_hardened_check%2F__init__.py;h=f28077421be91639687f3142631d0fb6a576e0de;hb=c1ebaa400da303eb39be555e54c92bf739d0424c;hp=cdb08288fa0f3ccf2b938cf88fb92462070da61f;hpb=9bbea5b5bad45aac84aadf83536e31f9bd5e395e;p=kconfig-hardened-check.git diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index cdb0828..f280774 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -1,9 +1,7 @@ #!/usr/bin/python3 """ -This tool helps me to check Linux kernel options against -my security hardening preferences for X86_64, ARM64, X86_32, and ARM. -Let the computers do their job! +This tool is for checking the security hardening options of the Linux kernel. Author: Alexander Popov @@ -42,9 +40,9 @@ def detect_arch(fname, archs): if arch is None: arch = option else: - return None, 'more than one supported architecture is detected' + return None, 'more than one supported microarchitecture is detected' if arch is None: - return None, 'failed to detect architecture' + return None, 'failed to detect microarchitecture' return arch, 'OK' @@ -167,14 +165,14 @@ def parse_kconfig_file(parsed_options, fname): if opt_is_on.match(line): option, value = line.split('=', 1) if value == 'is not set': - sys.exit(f'[!] ERROR: bad enabled kconfig option "{line}"') + sys.exit(f'[!] ERROR: bad enabled Kconfig option "{line}"') elif opt_is_off.match(line): option, value = line[2:].split(' ', 1) if value != 'is not set': - sys.exit(f'[!] ERROR: bad disabled kconfig option "{line}"') + sys.exit(f'[!] ERROR: bad disabled Kconfig option "{line}"') if option in parsed_options: - sys.exit(f'[!] ERROR: kconfig option "{line}" exists multiple times') + sys.exit(f'[!] ERROR: Kconfig option "{line}" exists multiple times') if option: parsed_options[option] = value @@ -202,7 +200,7 @@ def parse_cmdline_file(parsed_options, fname): def main(): # Report modes: # * verbose mode for - # - reporting about unknown kernel options in the kconfig + # - reporting about unknown kernel options in the Kconfig # - verbose printing of ComplexOptCheck items # * json mode for printing the results in JSON format report_modes = ['verbose', 'json', 'show_ok', 'show_fail'] @@ -210,14 +208,16 @@ def main(): parser = ArgumentParser(prog='kconfig-hardened-check', description='A tool for checking the security hardening options of the Linux kernel') parser.add_argument('--version', action='version', version='%(prog)s ' + __version__) - parser.add_argument('-p', '--print', choices=supported_archs, - help='print security hardening preferences for the selected architecture') - parser.add_argument('-c', '--config', - help='check the kernel kconfig file against these preferences (also supports *.gz files)') - parser.add_argument('-l', '--cmdline', - help='check the kernel cmdline file against these preferences') parser.add_argument('-m', '--mode', choices=report_modes, help='choose the report mode') + parser.add_argument('-c', '--config', + help='check the security hardening options in the kernel Kconfig file (also supports *.gz files)') + parser.add_argument('-l', '--cmdline', + help='check the security hardening options in the kernel cmdline file (contents of /proc/cmdline)') + parser.add_argument('-p', '--print', choices=supported_archs, + help='print the security hardening recommendations for the selected microarchitecture') + parser.add_argument('-g', '--generate', choices=supported_archs, + help='generate a Kconfig fragment with the security hardening options for the selected microarchitecture') args = parser.parse_args() mode = None @@ -232,6 +232,9 @@ def main(): if args.print: sys.exit('[!] ERROR: --config and --print can\'t be used together') + if args.generate: + sys.exit('[!] ERROR: --config and --generate can\'t be used together') + if mode != 'json': print(f'[+] Kconfig file to check: {args.config}') if args.cmdline: @@ -241,7 +244,7 @@ def main(): if arch is None: sys.exit(f'[!] ERROR: {msg}') if mode != 'json': - print(f'[+] Detected architecture: {arch}') + print(f'[+] Detected microarchitecture: {arch}') kernel_version, msg = detect_kernel_version(args.config) if kernel_version is None: @@ -256,14 +259,14 @@ def main(): else: print(f'[-] Can\'t detect the compiler: {msg}') - # add relevant kconfig checks to the checklist + # add relevant Kconfig checks to the checklist add_kconfig_checks(config_checklist, arch) if args.cmdline: # add relevant cmdline checks to the checklist add_cmdline_checks(config_checklist, arch) - # populate the checklist with the parsed kconfig data + # populate the checklist with the parsed Kconfig data parsed_kconfig_options = OrderedDict() parse_kconfig_file(parsed_kconfig_options, args.config) populate_with_data(config_checklist, parsed_kconfig_options, 'kconfig') @@ -297,18 +300,34 @@ def main(): sys.exit(0) elif args.cmdline: - sys.exit('[!] ERROR: checking cmdline doesn\'t work without checking kconfig') + sys.exit('[!] ERROR: checking cmdline doesn\'t work without checking Kconfig') if args.print: - if mode in ('show_ok', 'show_fail'): + assert(args.config is None and args.cmdline is None), 'unexpected args' + if mode and mode not in ('verbose', 'json'): sys.exit(f'[!] ERROR: wrong mode "{mode}" for --print') arch = args.print add_kconfig_checks(config_checklist, arch) add_cmdline_checks(config_checklist, arch) if mode != 'json': - print(f'[+] Printing kernel security hardening preferences for {arch}...') + print(f'[+] Printing kernel security hardening options for {arch}...') print_checklist(mode, config_checklist, False) sys.exit(0) + if args.generate: + assert(args.config is None and args.cmdline is None), 'unexpected args' + if mode: + sys.exit(f'[!] ERROR: wrong mode "{mode}" for --generate') + arch = args.generate + add_kconfig_checks(config_checklist, arch) + for opt in config_checklist: + if opt.name == 'CONFIG_ARCH_MMAP_RND_BITS': + continue # don't add CONFIG_ARCH_MMAP_RND_BITS because its value needs refinement + if opt.expected == 'is not set': + print(f'# {opt.name} is not set') + else: + print(f'{opt.name}={opt.expected}') + sys.exit(0) + parser.print_help() sys.exit(0)