X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig_hardened_check%2Fengine.py;h=2e86ef307f1eea244fa593dc5899f095b578c35b;hb=51a3a89b308be0b71059c294551651238da7230b;hp=b458d29ac35870196d6e2ead615d98fe2f473a08;hpb=328a89c7703915bc9c8eb6e66eebb6944caf94bb;p=kconfig-hardened-check.git diff --git a/kconfig_hardened_check/engine.py b/kconfig_hardened_check/engine.py index b458d29..2e86ef3 100644 --- a/kconfig_hardened_check/engine.py +++ b/kconfig_hardened_check/engine.py @@ -1,7 +1,15 @@ #!/usr/bin/python3 -# pylint: disable=missing-module-docstring,missing-class-docstring,missing-function-docstring -# pylint: disable=line-too-long,invalid-name,too-many-branches,too-many-statements +""" +This tool is for checking the security hardening options of the Linux kernel. + +Author: Alexander Popov + +This module is the engine of checks. +""" + +# pylint: disable=missing-class-docstring,missing-function-docstring +# pylint: disable=line-too-long,invalid-name,too-many-branches class OptCheck: @@ -35,10 +43,6 @@ class OptCheck: self.state = None self.result = None - @property - def type(self): - return None - def check(self): # handle the 'is present' check if self.expected == 'is present': @@ -52,12 +56,12 @@ class OptCheck: if self.expected == 'is not off': if self.state == 'off': self.result = 'FAIL: is off' - if self.state == '0': + elif self.state == '0': self.result = 'FAIL: is off, "0"' elif self.state is None: self.result = 'FAIL: is off, not found' else: - self.result = 'OK: is not off, "' + self.state + '"' + self.result = f'OK: is not off, "{self.state}"' return # handle the option value check @@ -69,7 +73,7 @@ class OptCheck: else: self.result = 'FAIL: is not found' else: - self.result = 'FAIL: "' + self.state + '"' + self.result = f'FAIL: "{self.state}"' def table_print(self, _mode, with_results): print(f'{self.name:<40}|{self.type:^7}|{self.expected:^12}|{self.decision:^10}|{self.reason:^18}', end='') @@ -99,6 +103,12 @@ class CmdlineCheck(OptCheck): return 'cmdline' +class SysctlCheck(OptCheck): + @property + def type(self): + return 'sysctl' + + class VersionCheck: def __init__(self, ver_expected): assert(ver_expected and isinstance(ver_expected, tuple) and len(ver_expected) == 2), \ @@ -113,18 +123,18 @@ class VersionCheck: def check(self): if self.ver[0] > self.ver_expected[0]: - self.result = 'OK: version >= ' + str(self.ver_expected[0]) + '.' + str(self.ver_expected[1]) + self.result = f'OK: version >= {self.ver_expected[0]}.{self.ver_expected[1]}' return if self.ver[0] < self.ver_expected[0]: - self.result = 'FAIL: version < ' + str(self.ver_expected[0]) + '.' + str(self.ver_expected[1]) + self.result = f'FAIL: version < {self.ver_expected[0]}.{self.ver_expected[1]}' return if self.ver[1] >= self.ver_expected[1]: - self.result = 'OK: version >= ' + str(self.ver_expected[0]) + '.' + str(self.ver_expected[1]) + self.result = f'OK: version >= {self.ver_expected[0]}.{self.ver_expected[1]}' return - self.result = 'FAIL: version < ' + str(self.ver_expected[0]) + '.' + str(self.ver_expected[1]) + self.result = f'FAIL: version < {self.ver_expected[0]}.{self.ver_expected[1]}' def table_print(self, _mode, with_results): - ver_req = 'kernel version >= ' + str(self.ver_expected[0]) + '.' + str(self.ver_expected[1]) + ver_req = f'kernel version >= {self.ver_expected[0]}.{self.ver_expected[1]}' print(f'{ver_req:<91}', end='') if with_results: print(f'| {self.result}', end='') @@ -137,7 +147,7 @@ class ComplexOptCheck: f'empty {self.__class__.__name__} check' assert(len(self.opts) != 1), \ f'useless {self.__class__.__name__} check: {opts}' - assert(isinstance(opts[0], (KconfigCheck, CmdlineCheck))), \ + assert(isinstance(opts[0], (KconfigCheck, CmdlineCheck, SysctlCheck))), \ f'invalid {self.__class__.__name__} check: {opts}' self.result = None @@ -155,7 +165,7 @@ class ComplexOptCheck: def table_print(self, mode, with_results): if mode == 'verbose': - print(f" {'<<< ' + self.__class__.__name__ + ' >>>':87}", end='') + print(f' {"<<< " + self.__class__.__name__ + " >>>":87}', end='') if with_results: print(f'| {self.result}', end='') for o in self.opts: @@ -234,7 +244,7 @@ class AND(ComplexOptCheck): return -SIMPLE_OPTION_TYPES = ('kconfig', 'version', 'cmdline') +SIMPLE_OPTION_TYPES = ('kconfig', 'cmdline', 'sysctl', 'version') def populate_simple_opt_with_data(opt, data, data_type): @@ -244,11 +254,13 @@ def populate_simple_opt_with_data(opt, data, data_type): f'invalid opt type "{opt.type}"' assert(data_type in SIMPLE_OPTION_TYPES), \ f'invalid data type "{data_type}"' + assert(data), \ + 'empty data' if data_type != opt.type: return - if data_type in ('kconfig', 'cmdline'): + if data_type in ('kconfig', 'cmdline', 'sysctl'): opt.state = data.get(opt.name, None) else: assert(data_type == 'version'), \ @@ -257,17 +269,16 @@ def populate_simple_opt_with_data(opt, data, data_type): def populate_opt_with_data(opt, data, data_type): - if opt.type == 'complex': + assert(opt.type != 'version'), 'a single VersionCheck is useless' + if opt.type != 'complex': + populate_simple_opt_with_data(opt, data, data_type) + else: for o in opt.opts: - if o.type == 'complex': + if o.type != 'complex': + populate_simple_opt_with_data(o, data, data_type) + else: # Recursion for nested ComplexOptCheck objects populate_opt_with_data(o, data, data_type) - else: - populate_simple_opt_with_data(o, data, data_type) - else: - assert(opt.type in ('kconfig', 'cmdline')), \ - f'bad type "{opt.type}" for a simple check' - populate_simple_opt_with_data(opt, data, data_type) def populate_with_data(checklist, data, data_type): @@ -275,6 +286,14 @@ def populate_with_data(checklist, data, data_type): populate_opt_with_data(opt, data, data_type) +def override_expected_value(checklist, name, new_val): + for opt in checklist: + if opt.name == name: + assert(opt.type in ('kconfig', 'cmdline', 'sysctl')), \ + f'overriding an expected value for "{opt.type}" checks is not supported yet' + opt.expected = new_val + + def perform_checks(checklist): for opt in checklist: opt.check()