Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
K
kernel-hardening-checker
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
fact-depend
kernel-hardening-checker
Commits
d6caae53
Commit
d6caae53
authored
Jun 12, 2023
by
Alexander Popov
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Improve the comments and README
parent
4dd0d2f9
Hide whitespace changes
Inline
Side-by-side
Showing
5 changed files
with
15 additions
and
24 deletions
+15
-24
README.md
README.md
+7
-8
__init__.py
kconfig_hardened_check/__init__.py
+5
-7
checks.py
kconfig_hardened_check/checks.py
+1
-3
engine.py
kconfig_hardened_check/engine.py
+1
-3
test_engine.py
kconfig_hardened_check/test_engine.py
+1
-3
No files found.
README.md
View file @
d6caae53
...
@@ -14,8 +14,8 @@ make our systems more secure.
...
@@ -14,8 +14,8 @@ make our systems more secure.
But nobody likes checking configs manually. So let the computers do their job!
But nobody likes checking configs manually. So let the computers do their job!
__kconfig-hardened-check__
helps me to check the Linux kernel options
__kconfig-hardened-check__
is a tool for checking the security hardening options of the Linux kernel.
against my security hardening preferences, which are based on the
The recommendations are based on
-
[
KSPP recommended settings
][
1
]
-
[
KSPP recommended settings
][
1
]
-
[
CLIP OS kernel configuration
][
2
]
-
[
CLIP OS kernel configuration
][
2
]
...
@@ -63,8 +63,8 @@ Some Linux distributions also provide `kconfig-hardened-check` as a package.
...
@@ -63,8 +63,8 @@ Some Linux distributions also provide `kconfig-hardened-check` as a package.
## Usage
## Usage
```
```
usage: kconfig-hardened-check [-h] [--version] [-p {X86_64,X86_32,ARM64,ARM}] [-c CONFIG]
usage: kconfig-hardened-check [-h] [--version] [-p {X86_64,X86_32,ARM64,ARM}] [-c CONFIG]
[-l CMDLINE]
[-
l CMDLINE] [-
m {verbose,json,show_ok,show_fail}]
[-m {verbose,json,show_ok,show_fail}]
A tool for checking the security hardening options of the Linux kernel
A tool for checking the security hardening options of the Linux kernel
...
@@ -72,12 +72,11 @@ options:
...
@@ -72,12 +72,11 @@ options:
-h, --help show this help message and exit
-h, --help show this help message and exit
--version show program's version number and exit
--version show program's version number and exit
-p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
-p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
print security hardening
preference
s for the selected architecture
print security hardening
option
s for the selected architecture
-c CONFIG, --config CONFIG
-c CONFIG, --config CONFIG
check the kernel kconfig file against these preferences (also supports
check security hardening options in the kernel kconfig file (also supports *.gz files)
*.gz files)
-l CMDLINE, --cmdline CMDLINE
-l CMDLINE, --cmdline CMDLINE
check
the kernel cmdline file against these preferences
check
security hardening options in the kernel cmdline file
-m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}
-m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}
choose the report mode
choose the report mode
```
```
...
...
kconfig_hardened_check/__init__.py
View file @
d6caae53
#!/usr/bin/python3
#!/usr/bin/python3
"""
"""
This tool helps me to check Linux kernel options against
This tool is for checking the security hardening options of the Linux kernel.
my security hardening preferences for X86_64, ARM64, X86_32, and ARM.
Let the computers do their job!
Author: Alexander Popov <alex.popov@linux.com>
Author: Alexander Popov <alex.popov@linux.com>
...
@@ -211,11 +209,11 @@ def main():
...
@@ -211,11 +209,11 @@ def main():
description
=
'A tool for checking the security hardening options of the Linux kernel'
)
description
=
'A tool for checking the security hardening options of the Linux kernel'
)
parser
.
add_argument
(
'--version'
,
action
=
'version'
,
version
=
'
%(prog)
s '
+
__version__
)
parser
.
add_argument
(
'--version'
,
action
=
'version'
,
version
=
'
%(prog)
s '
+
__version__
)
parser
.
add_argument
(
'-p'
,
'--print'
,
choices
=
supported_archs
,
parser
.
add_argument
(
'-p'
,
'--print'
,
choices
=
supported_archs
,
help
=
'print security hardening
preference
s for the selected architecture'
)
help
=
'print security hardening
option
s for the selected architecture'
)
parser
.
add_argument
(
'-c'
,
'--config'
,
parser
.
add_argument
(
'-c'
,
'--config'
,
help
=
'check
the kernel kconfig file against these preferences
(also supports *.gz files)'
)
help
=
'check
security hardening options in the kernel kconfig file
(also supports *.gz files)'
)
parser
.
add_argument
(
'-l'
,
'--cmdline'
,
parser
.
add_argument
(
'-l'
,
'--cmdline'
,
help
=
'check
the kernel cmdline file against these preferences
'
)
help
=
'check
security hardening options in the kernel cmdline file
'
)
parser
.
add_argument
(
'-m'
,
'--mode'
,
choices
=
report_modes
,
parser
.
add_argument
(
'-m'
,
'--mode'
,
choices
=
report_modes
,
help
=
'choose the report mode'
)
help
=
'choose the report mode'
)
args
=
parser
.
parse_args
()
args
=
parser
.
parse_args
()
...
@@ -306,7 +304,7 @@ def main():
...
@@ -306,7 +304,7 @@ def main():
add_kconfig_checks
(
config_checklist
,
arch
)
add_kconfig_checks
(
config_checklist
,
arch
)
add_cmdline_checks
(
config_checklist
,
arch
)
add_cmdline_checks
(
config_checklist
,
arch
)
if
mode
!=
'json'
:
if
mode
!=
'json'
:
print
(
f
'[+] Printing kernel security hardening
preference
s for {arch}...'
)
print
(
f
'[+] Printing kernel security hardening
option
s for {arch}...'
)
print_checklist
(
mode
,
config_checklist
,
False
)
print_checklist
(
mode
,
config_checklist
,
False
)
sys
.
exit
(
0
)
sys
.
exit
(
0
)
...
...
kconfig_hardened_check/checks.py
View file @
d6caae53
#!/usr/bin/python3
#!/usr/bin/python3
"""
"""
This tool helps me to check Linux kernel options against
This tool is for checking the security hardening options of the Linux kernel.
my security hardening preferences for X86_64, ARM64, X86_32, and ARM.
Let the computers do their job!
Author: Alexander Popov <alex.popov@linux.com>
Author: Alexander Popov <alex.popov@linux.com>
...
...
kconfig_hardened_check/engine.py
View file @
d6caae53
#!/usr/bin/python3
#!/usr/bin/python3
"""
"""
This tool helps me to check Linux kernel options against
This tool is for checking the security hardening options of the Linux kernel.
my security hardening preferences for X86_64, ARM64, X86_32, and ARM.
Let the computers do their job!
Author: Alexander Popov <alex.popov@linux.com>
Author: Alexander Popov <alex.popov@linux.com>
...
...
kconfig_hardened_check/test_engine.py
View file @
d6caae53
#!/usr/bin/python3
#!/usr/bin/python3
"""
"""
This tool helps me to check Linux kernel options against
This tool is for checking the security hardening options of the Linux kernel.
my security hardening preferences for X86_64, ARM64, X86_32, and ARM.
Let the computers do their job!
Author: Alexander Popov <alex.popov@linux.com>
Author: Alexander Popov <alex.popov@linux.com>
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment