Update the README after adding X86_32 support

And improve the style by the way.

diff --git a/README.md b/README.md
index 7321dd54e5ac14710fb750a4d6578d1a313b2b7e..10703ba6faf6235e3cd581247b2c1c21ae67cb63 100644 (file)
--- a/README.md
+++ b/README.md
@@ -22,13 +22,14 @@ __TODO:__ add hardening preferences for ARM.
 ### Usage
 ```
 #./kconfig-hardened-check.py
-usage: kconfig-hardened-check.py [-h] [-p {X86_64}] [-c CONFIG] [--debug]
+usage: kconfig-hardened-check.py [-h] [-p {X86_64,X86_32}] [-c CONFIG]
+                                 [--debug]
 
 Checks the hardening options in the Linux kernel config
 
 optional arguments:
   -h, --help            show this help message and exit
-  -p {X86_64}, --print {X86_64}
+  -p {X86_64,X86_32}, --print {X86_64,X86_32}
                         print hardening preferences for selected architecture
   -c CONFIG, --config CONFIG
                         check the config_file against these preferences
@@ -37,26 +38,26 @@ optional arguments:
 
 ### Script output for `Ubuntu 18.04 (Bionic Beaver)` kernel config
 ```
-#./kconfig-hardened-check.py -c config_files/ubuntu-bionic-generic.config 
-[+] Trying to detect architecture in "config_files/ubuntu-bionic-generic.config"...
+#./kconfig-hardened-check.py  -c config_files/distros/ubuntu-bionic-generic.config 
+[+] Trying to detect architecture in "config_files/distros/ubuntu-bionic-generic.config"...
 [+] Detected architecture: X86_64
-[+] Checking "config_files/ubuntu-bionic-generic.config" against hardening preferences...
+[+] Checking "config_files/distros/ubuntu-bionic-generic.config" against hardening preferences...
   option name                            | desired val | decision |       reason       ||        check result        
   ===================================================================================================================
   CONFIG_BUG                             |      y      |defconfig |  self_protection   ||             OK             
-  CONFIG_PAGE_TABLE_ISOLATION            |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_RETPOLINE                       |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_X86_SMAP                        |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_X86_INTEL_UMIP                  |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_STRICT_KERNEL_RWX               |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_RANDOMIZE_BASE                  |      y      |defconfig |  self_protection   ||             OK             
-  CONFIG_RANDOMIZE_MEMORY                |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_STACKPROTECTOR_STRONG           |      y      |defconfig |  self_protection   ||CONFIG_CC_STACKPROTECTOR_STRONG: OK ("y")
-  CONFIG_VMAP_STACK                      |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_THREAD_INFO_IN_TASK             |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_SLUB_DEBUG                      |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_STRICT_MODULE_RWX               |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_SYN_COOKIES                     |      y      |defconfig |  self_protection   ||             OK             
+  CONFIG_PAGE_TABLE_ISOLATION            |      y      |defconfig |  self_protection   ||             OK             
+  CONFIG_RANDOMIZE_MEMORY                |      y      |defconfig |  self_protection   ||             OK             
+  CONFIG_VMAP_STACK                      |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_BUG_ON_DATA_CORRUPTION          |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
   CONFIG_DEBUG_WX                        |      y      |   kspp   |  self_protection   ||             OK             
   CONFIG_SCHED_STACK_END_CHECK           |      y      |   kspp   |  self_protection   ||             OK             
@@ -97,7 +98,6 @@ optional arguments:
   CONFIG_SECCOMP_FILTER                  |      y      |defconfig | cut_attack_surface ||             OK             
   CONFIG_STRICT_DEVMEM                   |      y      |defconfig | cut_attack_surface ||             OK             
   CONFIG_IO_STRICT_DEVMEM                |      y      |   kspp   | cut_attack_surface ||     FAIL: "is not set"     
-  CONFIG_LEGACY_VSYSCALL_NONE            |      y      |   kspp   | cut_attack_surface ||     FAIL: "is not set"     
   CONFIG_ACPI_CUSTOM_METHOD              | is not set  |   kspp   | cut_attack_surface ||             OK             
   CONFIG_COMPAT_BRK                      | is not set  |   kspp   | cut_attack_surface ||             OK             
   CONFIG_DEVKMEM                         | is not set  |   kspp   | cut_attack_surface ||             OK             
@@ -107,10 +107,11 @@ optional arguments:
   CONFIG_KEXEC                           | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
   CONFIG_PROC_KCORE                      | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
   CONFIG_LEGACY_PTYS                     | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
+  CONFIG_HIBERNATION                     | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
+  CONFIG_LEGACY_VSYSCALL_NONE            |      y      |   kspp   | cut_attack_surface ||     FAIL: "is not set"     
   CONFIG_IA32_EMULATION                  | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
   CONFIG_X86_X32                         | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
   CONFIG_MODIFY_LDT_SYSCALL              | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
-  CONFIG_HIBERNATION                     | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
   CONFIG_X86_PTDUMP                      | is not set  |grsecurity| cut_attack_surface ||             OK             
   CONFIG_ZSMALLOC_STAT                   | is not set  |grsecurity| cut_attack_surface ||             OK             
   CONFIG_PAGE_OWNER                      | is not set  |grsecurity| cut_attack_surface ||             OK             
@@ -147,13 +148,13 @@ optional arguments:
 [-] config check is NOT PASSED: 56 errors
 ```
 
+__Go and fix them all!__
 
-N.B. If `CONFIG_GCC_PLUGIN*` options are automatically disabled during your kernel compilation,
-that means that your gcc doesn't support plugins. For example, if you have `gcc-7` on Ubuntu,
-try to install `gcc-7-plugin-dev` package, it should help.
 
+N.B. If `CONFIG_GCC_PLUGIN*` options are automatically disabled during your kernel compilation,
+then your gcc doesn't support plugins. For example, if you have `gcc-7` on Ubuntu, try to install
+`gcc-7-plugin-dev` package, it should help.
 
-__Go and fix them all!__
 
 [1]: http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
 [2]: https://grsecurity.net/