Skip to content

Make it easy to run kernel-hardening-checker #84

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
legoktm wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Make it easy to run kernel-hardening-checker #84

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,10 @@ fix: ## Fix scripts
@poetry run ruff format .
@poetry run ruff check . --fix

.PHONY: hardening-check
hardening-check: ## Run kernel-hardening-checker
@poetry run ./scripts/check-hardening

.PHONY: tiny-6.6
tiny-6.6: OUT:=$(SCRIPT_OUTPUT_PREFIX)-tiny-6.6.$(SCRIPT_OUTPUT_EXT)
tiny-6.6: ## Builds latest 6.6 kernel, unpatched
Expand Down
20 changes: 18 additions & 2 deletions poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ package-mode = false
ruff = "^0.11.8"
zizmor = "^1.6.0"
python-debian = "^1.0.1"
kernel-hardening-checker = {git = "https://github.com/a13xp0p0v/kernel-hardening-checker.git"}

[tool.ruff]
line-length = 100
Expand Down
26 changes: 26 additions & 0 deletions scripts/check-hardening
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
#!/bin/bash
# Run kernel-hardening-checker (https://github.com/a13xp0p0v/kernel-hardening-checker)
# against each of our non-tiny kernel configs. The architecture and kernel version
# are autodetected from each config's header.
#
# Run via `make hardening-check` so the checker from the Poetry environment is used.
set -e
set -u
set -o pipefail

repo_root="$(git rev-parse --show-toplevel)"

# Our non-tiny kernel configs (tiny configs are intentionally excluded).
configs=(
config-securedrop-6.6
config-workstation-6.6
config-workstation-6.18
)

for config in "${configs[@]}"; do
echo "=================================================================="
echo "Checking ${config}"
echo "=================================================================="
kernel-hardening-checker -c "${repo_root}/configs/${config}" -m show_fail
echo
done
Loading