X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig_hardened_check%2Fengine.py;h=4fdc222e7e8ac3d9fec6a2cf0a3c60c411f8c918;hb=f8e47e12ddf6b5c7b7562af6b85b8f65481e4b07;hp=0d27b775660d8f73a06f2537573dfcf4f29c4a30;hpb=895aecbfb8bc5e488db5098cd3fadf3f59d82881;p=kconfig-hardened-check.git diff --git a/kconfig_hardened_check/engine.py b/kconfig_hardened_check/engine.py index 0d27b77..4fdc222 100644 --- a/kconfig_hardened_check/engine.py +++ b/kconfig_hardened_check/engine.py @@ -1,9 +1,7 @@ #!/usr/bin/python3 """ -This tool helps me to check Linux kernel options against -my security hardening preferences for X86_64, ARM64, X86_32, and ARM. -Let the computers do their job! +This tool is for checking the security hardening options of the Linux kernel. Author: Alexander Popov @@ -13,6 +11,21 @@ This module is the engine of checks. # pylint: disable=missing-class-docstring,missing-function-docstring # pylint: disable=line-too-long,invalid-name,too-many-branches +GREEN_COLOR = '\x1b[32m' +RED_COLOR = '\x1b[31m' +COLOR_END = '\x1b[0m' + +def colorize_result(input_text): + if input_text is None: + return input_text + if input_text.startswith('OK'): + color = GREEN_COLOR + elif input_text.startswith('FAIL:'): + color = RED_COLOR + else: + assert(False), f'unexpected result "{input_text}"' + return f'{color}{input_text}{COLOR_END}' + class OptCheck: def __init__(self, reason, decision, name, expected): @@ -45,10 +58,6 @@ class OptCheck: self.state = None self.result = None - @property - def type(self): - return None - def check(self): # handle the 'is present' check if self.expected == 'is present': @@ -62,7 +71,7 @@ class OptCheck: if self.expected == 'is not off': if self.state == 'off': self.result = 'FAIL: is off' - if self.state == '0': + elif self.state == '0': self.result = 'FAIL: is off, "0"' elif self.state is None: self.result = 'FAIL: is off, not found' @@ -84,7 +93,7 @@ class OptCheck: def table_print(self, _mode, with_results): print(f'{self.name:<40}|{self.type:^7}|{self.expected:^12}|{self.decision:^10}|{self.reason:^18}', end='') if with_results: - print(f'| {self.result}', end='') + print(f'| {colorize_result(self.result)}', end='') def json_dump(self, with_results): dump = [self.name, self.type, self.expected, self.decision, self.reason] @@ -109,6 +118,12 @@ class CmdlineCheck(OptCheck): return 'cmdline' +class SysctlCheck(OptCheck): + @property + def type(self): + return 'sysctl' + + class VersionCheck: def __init__(self, ver_expected): assert(ver_expected and isinstance(ver_expected, tuple) and len(ver_expected) == 2), \ @@ -137,7 +152,7 @@ class VersionCheck: ver_req = f'kernel version >= {self.ver_expected[0]}.{self.ver_expected[1]}' print(f'{ver_req:<91}', end='') if with_results: - print(f'| {self.result}', end='') + print(f'| {colorize_result(self.result)}', end='') class ComplexOptCheck: @@ -147,7 +162,7 @@ class ComplexOptCheck: f'empty {self.__class__.__name__} check' assert(len(self.opts) != 1), \ f'useless {self.__class__.__name__} check: {opts}' - assert(isinstance(opts[0], (KconfigCheck, CmdlineCheck))), \ + assert(isinstance(opts[0], (KconfigCheck, CmdlineCheck, SysctlCheck))), \ f'invalid {self.__class__.__name__} check: {opts}' self.result = None @@ -167,7 +182,7 @@ class ComplexOptCheck: if mode == 'verbose': print(f' {"<<< " + self.__class__.__name__ + " >>>":87}', end='') if with_results: - print(f'| {self.result}', end='') + print(f'| {colorize_result(self.result)}', end='') for o in self.opts: print() o.table_print(mode, with_results) @@ -175,7 +190,7 @@ class ComplexOptCheck: o = self.opts[0] o.table_print(mode, False) if with_results: - print(f'| {self.result}', end='') + print(f'| {colorize_result(self.result)}', end='') def json_dump(self, with_results): dump = self.opts[0].json_dump(False) @@ -244,7 +259,7 @@ class AND(ComplexOptCheck): return -SIMPLE_OPTION_TYPES = ('kconfig', 'version', 'cmdline') +SIMPLE_OPTION_TYPES = ('kconfig', 'cmdline', 'sysctl', 'version') def populate_simple_opt_with_data(opt, data, data_type): @@ -254,11 +269,13 @@ def populate_simple_opt_with_data(opt, data, data_type): f'invalid opt type "{opt.type}"' assert(data_type in SIMPLE_OPTION_TYPES), \ f'invalid data type "{data_type}"' + assert(data), \ + 'empty data' if data_type != opt.type: return - if data_type in ('kconfig', 'cmdline'): + if data_type in ('kconfig', 'cmdline', 'sysctl'): opt.state = data.get(opt.name, None) else: assert(data_type == 'version'), \ @@ -267,17 +284,16 @@ def populate_simple_opt_with_data(opt, data, data_type): def populate_opt_with_data(opt, data, data_type): - if opt.type == 'complex': + assert(opt.type != 'version'), 'a single VersionCheck is useless' + if opt.type != 'complex': + populate_simple_opt_with_data(opt, data, data_type) + else: for o in opt.opts: - if o.type == 'complex': + if o.type != 'complex': + populate_simple_opt_with_data(o, data, data_type) + else: # Recursion for nested ComplexOptCheck objects populate_opt_with_data(o, data, data_type) - else: - populate_simple_opt_with_data(o, data, data_type) - else: - assert(opt.type in ('kconfig', 'cmdline')), \ - f'bad type "{opt.type}" for a simple check' - populate_simple_opt_with_data(opt, data, data_type) def populate_with_data(checklist, data, data_type): @@ -285,6 +301,14 @@ def populate_with_data(checklist, data, data_type): populate_opt_with_data(opt, data, data_type) +def override_expected_value(checklist, name, new_val): + for opt in checklist: + if opt.name == name: + assert(opt.type in ('kconfig', 'cmdline', 'sysctl')), \ + f'overriding an expected value for "{opt.type}" checks is not supported yet' + opt.expected = new_val + + def perform_checks(checklist): for opt in checklist: opt.check()