X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kernel_hardening_checker%2Fengine.py;h=56aa80f44e17589377390453789f5a8a86f500e5;hb=b87f0b675171581857d3cb2f01ce74f1dcf72248;hp=4e4eee91b413c1b1f1408b92645e285a9aab1539;hpb=f0f405b3d94a905f08778f103e6831f87a349583;p=kconfig-hardened-check.git diff --git a/kernel_hardening_checker/engine.py b/kernel_hardening_checker/engine.py index 4e4eee9..56aa80f 100644 --- a/kernel_hardening_checker/engine.py +++ b/kernel_hardening_checker/engine.py @@ -11,12 +11,14 @@ This module is the engine of checks. # pylint: disable=missing-class-docstring,missing-function-docstring # pylint: disable=line-too-long,invalid-name,too-many-branches +import sys + GREEN_COLOR = '\x1b[32m' RED_COLOR = '\x1b[31m' COLOR_END = '\x1b[0m' def colorize_result(input_text): - if input_text is None: + if input_text is None or not sys.stdout.isatty(): return input_text if input_text.startswith('OK'): color = GREEN_COLOR @@ -57,6 +59,15 @@ class OptCheck: self.state = None self.result = None + @property + def opt_type(self): + return None + + def set_state(self, data): + assert(data is None or isinstance(data, str)), \ + f'invalid state "{data}" for "{self.name}" check' + self.state = data + def check(self): # handle the 'is present' check if self.expected == 'is present': @@ -90,65 +101,87 @@ class OptCheck: self.result = f'FAIL: "{self.state}"' def table_print(self, _mode, with_results): - print(f'{self.name:<40}|{self.type:^7}|{self.expected:^12}|{self.decision:^10}|{self.reason:^18}', end='') + print(f'{self.name:<40}|{self.opt_type:^7}|{self.expected:^12}|{self.decision:^10}|{self.reason:^18}', end='') if with_results: print(f'| {colorize_result(self.result)}', end='') def json_dump(self, with_results): - dump = [self.name, self.type, self.expected, self.decision, self.reason] + dump = { + "option_name": self.name, + "type": self.opt_type, + "desired_val": self.expected, + "decision": self.decision, + "reason": self.reason, + } if with_results: - dump.append(self.result) + dump["check_result"] = self.result + dump["check_result_bool"] = self.result.startswith('OK') return dump class KconfigCheck(OptCheck): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) - self.name = 'CONFIG_' + self.name + self.name = f'CONFIG_{self.name}' @property - def type(self): + def opt_type(self): return 'kconfig' class CmdlineCheck(OptCheck): @property - def type(self): + def opt_type(self): return 'cmdline' class SysctlCheck(OptCheck): @property - def type(self): + def opt_type(self): return 'sysctl' class VersionCheck: def __init__(self, ver_expected): - assert(ver_expected and isinstance(ver_expected, tuple) and len(ver_expected) == 2), \ - f'invalid version "{ver_expected}" for VersionCheck' + assert(ver_expected and isinstance(ver_expected, tuple) and len(ver_expected) == 3), \ + f'invalid expected version "{ver_expected}" for VersionCheck (1)' + assert(all(map(lambda x: isinstance(x, int), ver_expected))), \ + f'invalid expected version "{ver_expected}" for VersionCheck (2)' self.ver_expected = ver_expected self.ver = () self.result = None @property - def type(self): + def opt_type(self): return 'version' + def set_state(self, data): + assert(data and isinstance(data, tuple) and len(data) >= 3), \ + f'invalid version "{data}" for VersionCheck' + self.ver = data[:3] + def check(self): if self.ver[0] > self.ver_expected[0]: - self.result = f'OK: version >= {self.ver_expected[0]}.{self.ver_expected[1]}' + self.result = f'OK: version >= {self.ver_expected}' return if self.ver[0] < self.ver_expected[0]: - self.result = f'FAIL: version < {self.ver_expected[0]}.{self.ver_expected[1]}' + self.result = f'FAIL: version < {self.ver_expected}' + return + # self.ver[0] and self.ver_expected[0] are equal + if self.ver[1] > self.ver_expected[1]: + self.result = f'OK: version >= {self.ver_expected}' + return + if self.ver[1] < self.ver_expected[1]: + self.result = f'FAIL: version < {self.ver_expected}' return - if self.ver[1] >= self.ver_expected[1]: - self.result = f'OK: version >= {self.ver_expected[0]}.{self.ver_expected[1]}' + # self.ver[1] and self.ver_expected[1] are equal too + if self.ver[2] >= self.ver_expected[2]: + self.result = f'OK: version >= {self.ver_expected}' return - self.result = f'FAIL: version < {self.ver_expected[0]}.{self.ver_expected[1]}' + self.result = f'FAIL: version < {self.ver_expected}' def table_print(self, _mode, with_results): - ver_req = f'kernel version >= {self.ver_expected[0]}.{self.ver_expected[1]}' + ver_req = f'kernel version >= {self.ver_expected}' print(f'{ver_req:<91}', end='') if with_results: print(f'| {colorize_result(self.result)}', end='') @@ -166,7 +199,7 @@ class ComplexOptCheck: self.result = None @property - def type(self): + def opt_type(self): return 'complex' @property @@ -179,7 +212,8 @@ class ComplexOptCheck: def table_print(self, mode, with_results): if mode == 'verbose': - print(f' {"<<< " + self.__class__.__name__ + " >>>":87}', end='') + class_name = f'<<< {self.__class__.__name__} >>>' + print(f' {class_name:87}', end='') if with_results: print(f'| {colorize_result(self.result)}', end='') for o in self.opts: @@ -194,7 +228,9 @@ class ComplexOptCheck: def json_dump(self, with_results): dump = self.opts[0].json_dump(False) if with_results: - dump.append(self.result) + # Add the 'check_result' and 'check_result_bool' keys to the dictionary + dump["check_result"] = self.result + dump["check_result_bool"] = self.result.startswith('OK') return dump @@ -262,33 +298,33 @@ SIMPLE_OPTION_TYPES = ('kconfig', 'cmdline', 'sysctl', 'version') def populate_simple_opt_with_data(opt, data, data_type): - assert(opt.type != 'complex'), \ + assert(opt.opt_type != 'complex'), \ f'unexpected ComplexOptCheck "{opt.name}"' - assert(opt.type in SIMPLE_OPTION_TYPES), \ - f'invalid opt type "{opt.type}"' + assert(opt.opt_type in SIMPLE_OPTION_TYPES), \ + f'invalid opt_type "{opt.opt_type}"' assert(data_type in SIMPLE_OPTION_TYPES), \ - f'invalid data type "{data_type}"' + f'invalid data_type "{data_type}"' assert(data), \ 'empty data' - if data_type != opt.type: + if data_type != opt.opt_type: return if data_type in ('kconfig', 'cmdline', 'sysctl'): - opt.state = data.get(opt.name, None) + opt.set_state(data.get(opt.name, None)) else: assert(data_type == 'version'), \ - f'unexpected data type "{data_type}"' - opt.ver = data + f'unexpected data_type "{data_type}"' + opt.set_state(data) def populate_opt_with_data(opt, data, data_type): - assert(opt.type != 'version'), 'a single VersionCheck is useless' - if opt.type != 'complex': + assert(opt.opt_type != 'version'), 'a single VersionCheck is useless' + if opt.opt_type != 'complex': populate_simple_opt_with_data(opt, data, data_type) else: for o in opt.opts: - if o.type != 'complex': + if o.opt_type != 'complex': populate_simple_opt_with_data(o, data, data_type) else: # Recursion for nested ComplexOptCheck objects @@ -303,8 +339,8 @@ def populate_with_data(checklist, data, data_type): def override_expected_value(checklist, name, new_val): for opt in checklist: if opt.name == name: - assert(opt.type in ('kconfig', 'cmdline', 'sysctl')), \ - f'overriding an expected value for "{opt.type}" checks is not supported yet' + assert(opt.opt_type in ('kconfig', 'cmdline', 'sysctl')), \ + f'overriding an expected value for "{opt.opt_type}" checks is not supported yet' opt.expected = new_val