--kernel-version option will extract the version in /proc/version.
This is especially useful on embedded systems where config.gz doesn't
always contain the kernel version

Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com>

This is guaranteed to work everything including NixOS

The GitHub Actions virtual machine has such a sysctl:
  fs.binfmt_misc.llvm-14-runtime/binfmt = enabled

This example shows that sysctl names may contain the / symbol.

Refers to #65

Refers to #65

Don't emit ERROR here. Even GitHub Actions machines have repeated options
in /proc/cmdline.

Also see the comment in cmdline parsing for x86:
https://elixir.bootlin.com/linux/v5.16.7/source/arch/x86/boot/cmdline.c#L21
```
In accordance with standard Linux practice, if this option is repeated,
this returns the last instance on the command line.
```

And fix the wording in the error message by the way.

Refers to #65

The Kconfig fragment should describe the microarchitecture to avoid mistakes.

I tested CONFIG_CMDLINE and CONFIG_BOOT_CONFIG mechanisms.
They allow passing additional boot parameters for the Linux kernel.

I see that all boot parameters are collected in /proc/cmdline.

So /proc/cmdline is the only information source that we should check to
analyze the Linux kernel boot parameters.

With this argument the tool generates a Kconfig fragment with the security
hardening options for the selected microarchitecture.

Refers to #67.

This Kconfig fragment can be merged with the existing Linux kernel config:

$ ./bin/kconfig-hardened-check -g X86_64 > /tmp/fragment
$ cd ~/linux-src/
$ ./scripts/kconfig/merge_config.sh .config /tmp/fragment
Using .config as base
Merging /tmp/fragment
Value of CONFIG_BUG_ON_DATA_CORRUPTION is redefined by fragment /tmp/fragment:
Previous value: # CONFIG_BUG_ON_DATA_CORRUPTION is not set
New value: CONFIG_BUG_ON_DATA_CORRUPTION=y
...

Use new override_expected_value() for that.

This is needed to avoid wrong recommendations for ARM64 and ARM, where
CONFIG_ARCH_MMAP_RND_BITS_MAX depends on the paging configuration.

Refers to #80

This condition has been checked at the beginning of the function.

Noticed this in the code coverage report.

These objects should be compared for identity with None using 'is' operator.

Part IV, sys.exit()

Part III, strings

Part II, assert()

Part I, print()

Thanks to @izh1979

Thanks to @izh1979