From: Alexander Popov <alex.popov@linux.com>
Date: Mon, 12 Jun 2023 14:46:25 +0000 (+0300)
Subject: Update the README
X-Git-Tag: v0.6.6~140
X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=eec17478288683baa6f3b54ccf5862414f767e18;p=kconfig-hardened-check.git

Update the README

Refers to #67.
---

diff --git a/README.md b/README.md
index dbdc1f3..735a891 100644
--- a/README.md
+++ b/README.md
@@ -63,24 +63,28 @@ Some Linux distributions also provide `kconfig-hardened-check` as a package.
 
 ## Usage
 ```
-usage: kconfig-hardened-check [-h] [--version] [-p {X86_64,X86_32,ARM64,ARM}] [-c CONFIG]
-                              [-l CMDLINE] [-m {verbose,json,show_ok,show_fail}]
+usage: kconfig-hardened-check [-h] [--version] [-m {verbose,json,show_ok,show_fail}]
+                              [-c CONFIG] [-l CMDLINE] [-p {X86_64,X86_32,ARM64,ARM}]
+                              [-g {X86_64,X86_32,ARM64,ARM}]
 
 A tool for checking the security hardening options of the Linux kernel
 
 options:
   -h, --help            show this help message and exit
   --version             show program's version number and exit
-  -p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
-                        print the security hardening recommendations for the selected
-                        microarchitecture
+  -m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}
+                        choose the report mode
   -c CONFIG, --config CONFIG
-                        check the security hardening options in the kernel kconfig file (also
-                        supports *.gz files)
+                        check the security hardening options in the kernel Kconfig file
+                        (also supports *.gz files)
   -l CMDLINE, --cmdline CMDLINE
                         check the security hardening options in the kernel cmdline file
-  -m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}
-                        choose the report mode
+  -p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
+                        print the security hardening recommendations for the selected
+                        microarchitecture
+  -g {X86_64,X86_32,ARM64,ARM}, --generate {X86_64,X86_32,ARM64,ARM}
+                        generate a Kconfig fragment with the security hardening options for
+                        the selected microarchitecture
 ```
 
 ## Output modes
@@ -338,14 +342,22 @@ sysrq_always_enabled                    |cmdline| is not set |    my    |cut_att
 [+] Config check is finished: 'OK' - 122 / 'FAIL' - 101
 ```
 
-## kconfig-hardened-check versioning
-
-I usually update the kernel security hardening recommendations every few kernel releases.
+## Generating a Kconfig fragment with the security hardening options
 
-So the version of `kconfig-hardened-check` is associated with the corresponding version of the kernel.
-
-The version format is: __[major_number].[kernel_version].[kernel_patchlevel]__
+With the `-g` argument the tool generates a Kconfig fragment with the security hardening options for the selected microarchitecture.
 
+This Kconfig fragment can be merged with the existing Linux kernel config:
+```
+$ ./bin/kconfig-hardened-check -g X86_64 > /tmp/fragment
+$ cd ~/linux-src/
+$ ./scripts/kconfig/merge_config.sh .config /tmp/fragment
+Using .config as base
+Merging /tmp/fragment
+Value of CONFIG_BUG_ON_DATA_CORRUPTION is redefined by fragment /tmp/fragment:
+Previous value: # CONFIG_BUG_ON_DATA_CORRUPTION is not set
+New value: CONFIG_BUG_ON_DATA_CORRUPTION=y
+ ...
+```
 
 ## Questions and answers