Commit d6caae53 by Alexander Popov

Improve the comments and README

parent 4dd0d2f9
...@@ -14,8 +14,8 @@ make our systems more secure. ...@@ -14,8 +14,8 @@ make our systems more secure.
But nobody likes checking configs manually. So let the computers do their job! But nobody likes checking configs manually. So let the computers do their job!
__kconfig-hardened-check__ helps me to check the Linux kernel options __kconfig-hardened-check__ is a tool for checking the security hardening options of the Linux kernel.
against my security hardening preferences, which are based on the The recommendations are based on
- [KSPP recommended settings][1] - [KSPP recommended settings][1]
- [CLIP OS kernel configuration][2] - [CLIP OS kernel configuration][2]
...@@ -63,8 +63,8 @@ Some Linux distributions also provide `kconfig-hardened-check` as a package. ...@@ -63,8 +63,8 @@ Some Linux distributions also provide `kconfig-hardened-check` as a package.
## Usage ## Usage
``` ```
usage: kconfig-hardened-check [-h] [--version] [-p {X86_64,X86_32,ARM64,ARM}] [-c CONFIG] usage: kconfig-hardened-check [-h] [--version] [-p {X86_64,X86_32,ARM64,ARM}] [-c CONFIG] [-l CMDLINE]
[-l CMDLINE] [-m {verbose,json,show_ok,show_fail}] [-m {verbose,json,show_ok,show_fail}]
A tool for checking the security hardening options of the Linux kernel A tool for checking the security hardening options of the Linux kernel
...@@ -72,12 +72,11 @@ options: ...@@ -72,12 +72,11 @@ options:
-h, --help show this help message and exit -h, --help show this help message and exit
--version show program's version number and exit --version show program's version number and exit
-p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM} -p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
print security hardening preferences for the selected architecture print security hardening options for the selected architecture
-c CONFIG, --config CONFIG -c CONFIG, --config CONFIG
check the kernel kconfig file against these preferences (also supports check security hardening options in the kernel kconfig file (also supports *.gz files)
*.gz files)
-l CMDLINE, --cmdline CMDLINE -l CMDLINE, --cmdline CMDLINE
check the kernel cmdline file against these preferences check security hardening options in the kernel cmdline file
-m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail} -m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}
choose the report mode choose the report mode
``` ```
......
#!/usr/bin/python3 #!/usr/bin/python3
""" """
This tool helps me to check Linux kernel options against This tool is for checking the security hardening options of the Linux kernel.
my security hardening preferences for X86_64, ARM64, X86_32, and ARM.
Let the computers do their job!
Author: Alexander Popov <alex.popov@linux.com> Author: Alexander Popov <alex.popov@linux.com>
...@@ -211,11 +209,11 @@ def main(): ...@@ -211,11 +209,11 @@ def main():
description='A tool for checking the security hardening options of the Linux kernel') description='A tool for checking the security hardening options of the Linux kernel')
parser.add_argument('--version', action='version', version='%(prog)s ' + __version__) parser.add_argument('--version', action='version', version='%(prog)s ' + __version__)
parser.add_argument('-p', '--print', choices=supported_archs, parser.add_argument('-p', '--print', choices=supported_archs,
help='print security hardening preferences for the selected architecture') help='print security hardening options for the selected architecture')
parser.add_argument('-c', '--config', parser.add_argument('-c', '--config',
help='check the kernel kconfig file against these preferences (also supports *.gz files)') help='check security hardening options in the kernel kconfig file (also supports *.gz files)')
parser.add_argument('-l', '--cmdline', parser.add_argument('-l', '--cmdline',
help='check the kernel cmdline file against these preferences') help='check security hardening options in the kernel cmdline file')
parser.add_argument('-m', '--mode', choices=report_modes, parser.add_argument('-m', '--mode', choices=report_modes,
help='choose the report mode') help='choose the report mode')
args = parser.parse_args() args = parser.parse_args()
...@@ -306,7 +304,7 @@ def main(): ...@@ -306,7 +304,7 @@ def main():
add_kconfig_checks(config_checklist, arch) add_kconfig_checks(config_checklist, arch)
add_cmdline_checks(config_checklist, arch) add_cmdline_checks(config_checklist, arch)
if mode != 'json': if mode != 'json':
print(f'[+] Printing kernel security hardening preferences for {arch}...') print(f'[+] Printing kernel security hardening options for {arch}...')
print_checklist(mode, config_checklist, False) print_checklist(mode, config_checklist, False)
sys.exit(0) sys.exit(0)
......
#!/usr/bin/python3 #!/usr/bin/python3
""" """
This tool helps me to check Linux kernel options against This tool is for checking the security hardening options of the Linux kernel.
my security hardening preferences for X86_64, ARM64, X86_32, and ARM.
Let the computers do their job!
Author: Alexander Popov <alex.popov@linux.com> Author: Alexander Popov <alex.popov@linux.com>
......
#!/usr/bin/python3 #!/usr/bin/python3
""" """
This tool helps me to check Linux kernel options against This tool is for checking the security hardening options of the Linux kernel.
my security hardening preferences for X86_64, ARM64, X86_32, and ARM.
Let the computers do their job!
Author: Alexander Popov <alex.popov@linux.com> Author: Alexander Popov <alex.popov@linux.com>
......
#!/usr/bin/python3 #!/usr/bin/python3
""" """
This tool helps me to check Linux kernel options against This tool is for checking the security hardening options of the Linux kernel.
my security hardening preferences for X86_64, ARM64, X86_32, and ARM.
Let the computers do their job!
Author: Alexander Popov <alex.popov@linux.com> Author: Alexander Popov <alex.popov@linux.com>
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment