Skip to content

Commit 503c1a4

Browse files
a13xp0p0va13xp0p0v
committed
Merge branch 'man'
Refers to #195.
2 parents 5cd339a + 2c5faaf commit 503c1a4

File tree

3 files changed

+127
-46
lines changed

3 files changed

+127
-46
lines changed

‎README.md‎

Lines changed: 36 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ License: GPL-3.0.
3434
`kernel-hardening-checker` supports checking:
3535

3636
- Kconfig options (compile-time)
37-
- Kernel cmdline arguments (boot-time)
37+
- Kernel command line arguments (boot-time)
3838
- Sysctl parameters (runtime)
3939

4040
Supported architectures:
@@ -60,10 +60,9 @@ or exploitation techniques.
6060

6161
## Attention!
6262

63-
Changing Linux kernel security parameters may also affect system performance
64-
and functionality of userspace software. So for choosing these parameters, consider
65-
the threat model of your Linux-based information system and perform thorough testing
66-
of its typical workload.
63+
Please note that changing the Linux kernel security parameters may also affect system performance
64+
and functionality of userspace software. Therefore, when setting these parameters, consider
65+
the threat model of your Linux-based information system and thoroughly test its typical workload.
6766

6867
## Installation
6968

@@ -82,9 +81,11 @@ There are multiple options:
8281
## Usage
8382
```
8483
$ ./bin/kernel-hardening-checker -h
85-
usage: kernel-hardening-checker [-h] [--version] [-m {verbose,json,show_ok,show_fail}]
86-
[-a] [-c CONFIG] [-v KERNEL_VERSION] [-l CMDLINE]
87-
[-s SYSCTL] [-p {X86_64,X86_32,ARM64,ARM,RISCV}]
84+
usage: kernel-hardening-checker [-h] [--version]
85+
[-m {verbose,json,show_ok,show_fail}] [-a]
86+
[-c CONFIG] [-v KERNEL_VERSION] [-l CMDLINE]
87+
[-s SYSCTL]
88+
[-p {X86_64,X86_32,ARM64,ARM,RISCV}]
8889
[-g {X86_64,X86_32,ARM64,ARM,RISCV}]
8990

9091
A tool for checking the security hardening options of the Linux kernel
@@ -93,43 +94,44 @@ options:
9394
-h, --help show this help message and exit
9495
--version show program's version number and exit
9596
-m, --mode {verbose,json,show_ok,show_fail}
96-
choose the report mode
97-
-a, --autodetect autodetect and check the security hardening options of the
98-
running kernel
99-
-c, --config CONFIG check the security hardening options in the Kconfig file (also
100-
supports *.gz files)
97+
select a special output mode instead of the default
98+
one
99+
-a, --autodetect autodetect and check the security hardening options of
100+
the running kernel
101+
-c, --config CONFIG check the security hardening options in a Kconfig file
102+
(also supports *.gz files)
101103
-v, --kernel-version KERNEL_VERSION
102-
extract version from the kernel version file (contents of
103-
/proc/version) instead of Kconfig file
104+
extract the kernel version from a version file (such
105+
as /proc/version) instead of using a Kconfig file
104106
-l, --cmdline CMDLINE
105-
check the security hardening options in the kernel cmdline file
106-
(contents of /proc/cmdline)
107-
-s, --sysctl SYSCTL check the security hardening options in the sysctl output file
108-
(`sudo sysctl -a > file`)
107+
check the security hardening options in a kernel
108+
command line file (such as /proc/cmdline)
109+
-s, --sysctl SYSCTL check the security hardening options in a sysctl
110+
output file (the result of "sudo sysctl -a > file")
109111
-p, --print {X86_64,X86_32,ARM64,ARM,RISCV}
110-
print the security hardening recommendations for the selected
111-
architecture
112+
print security hardening recommendations for the
113+
selected architecture
112114
-g, --generate {X86_64,X86_32,ARM64,ARM,RISCV}
113-
generate a Kconfig fragment with the security hardening options
114-
for the selected architecture
115+
generate a Kconfig fragment containing the security
116+
hardening options for the selected architecture
115117
```
116118
117119
## Output modes
118120
119121
- no `-m` argument for the default output mode (see the example below)
120122
- `-m verbose` for printing additional info:
121-
- config options without a corresponding check
122-
- internals of complex checks with AND/OR, like this:
123-
```
124-
-------------------------------------------------------------------------------------------
125-
<<< OR >>>
126-
CONFIG_STRICT_DEVMEM |kconfig|cut_attack_surface|defconfig | y
127-
CONFIG_DEVMEM |kconfig|cut_attack_surface| kspp | is not set
128-
-------------------------------------------------------------------------------------------
129-
```
130-
- `-m show_fail` for showing only the failed checks
131-
- `-m show_ok` for showing only the successful checks
123+
- the configuration options without a corresponding check
124+
- the internals of complex checks with AND/OR, like this:
125+
```
126+
-------------------------------------------------------------------------------------------
127+
<<< OR >>>
128+
CONFIG_STRICT_DEVMEM |kconfig|cut_attack_surface|defconfig | y
129+
CONFIG_DEVMEM |kconfig|cut_attack_surface| kspp | is not set
130+
-------------------------------------------------------------------------------------------
131+
```
132132
- `-m json` for printing the results in JSON format (for combining `kernel-hardening-checker` with other tools)
133+
- `-m show_ok` for showing only successful checks
134+
- `-m show_fail` for showing only failed checks
133135
134136
## Example output
135137
```

‎kernel_hardening_checker/__init__.py‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -290,13 +290,13 @@ def parse_sysctl_file(mode: StrOrNone, parsed_options: Dict[str, str], fname: st
290290
parsed_options[option] = value
291291

292292
# let's check the presence of some ancient sysctl option
293-
# to ensure that we are parsing the output of `sudo sysctl -a > file`
293+
# to ensure that we are parsing the output of "sudo sysctl -a > file"
294294
if 'kernel.printk' not in parsed_options and mode != 'json':
295-
print(f'[!] WARNING: ancient sysctl options are not found in {fname}, try checking the output of `sudo sysctl -a`')
295+
print(f'[!] WARNING: ancient sysctl options are not found in {fname}, try checking the output of "sudo sysctl -a"')
296296

297297
# let's check the presence of a sysctl option available for root
298298
if 'kernel.cad_pid' not in parsed_options and mode != 'json':
299-
print(f'[!] WARNING: sysctl options available for root are not found in {fname}, try checking the output of `sudo sysctl -a`')
299+
print(f'[!] WARNING: sysctl options available for root are not found in {fname}, try checking the output of "sudo sysctl -a"')
300300

301301

302302
def refine_check(mode: StrOrNone, checklist: List[ChecklistObjType], parsed_options: Dict[str, str],
@@ -407,26 +407,26 @@ def main() -> None:
407407
# - reporting about unknown kernel options in the Kconfig
408408
# - verbose printing of ComplexOptCheck items
409409
# * json mode for printing the results in JSON format
410-
report_modes = ['verbose', 'json', 'show_ok', 'show_fail']
410+
output_modes = ['verbose', 'json', 'show_ok', 'show_fail']
411411
parser = ArgumentParser(prog='kernel-hardening-checker',
412412
description='A tool for checking the security hardening options of the Linux kernel')
413413
parser.add_argument('--version', action='version', version=f'%(prog)s {__version__}')
414-
parser.add_argument('-m', '--mode', choices=report_modes,
415-
help='choose the report mode')
414+
parser.add_argument('-m', '--mode', choices=output_modes,
415+
help='select a special output mode instead of the default one')
416416
parser.add_argument('-a', '--autodetect', action='store_true',
417417
help='autodetect and check the security hardening options of the running kernel')
418418
parser.add_argument('-c', '--config',
419-
help='check the security hardening options in the Kconfig file (also supports *.gz files)')
419+
help='check the security hardening options in a Kconfig file (also supports *.gz files)')
420420
parser.add_argument('-v', '--kernel-version',
421-
help='extract version from the kernel version file (contents of /proc/version) instead of Kconfig file')
421+
help='extract the kernel version from a version file (such as /proc/version) instead of using a Kconfig file')
422422
parser.add_argument('-l', '--cmdline',
423-
help='check the security hardening options in the kernel cmdline file (contents of /proc/cmdline)')
423+
help='check the security hardening options in a kernel command line file (such as /proc/cmdline)')
424424
parser.add_argument('-s', '--sysctl',
425-
help='check the security hardening options in the sysctl output file (`sudo sysctl -a > file`)')
425+
help='check the security hardening options in a sysctl output file (the result of "sudo sysctl -a > file")')
426426
parser.add_argument('-p', '--print', choices=SUPPORTED_ARCHS,
427-
help='print the security hardening recommendations for the selected architecture')
427+
help='print security hardening recommendations for the selected architecture')
428428
parser.add_argument('-g', '--generate', choices=SUPPORTED_ARCHS,
429-
help='generate a Kconfig fragment with the security hardening options for the selected architecture')
429+
help='generate a Kconfig fragment containing the security hardening options for the selected architecture')
430430
args = parser.parse_args()
431431

432432
mode = None

‎man/kernel-hardening-checker.1‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
.TH KERNEL-HARDENING-CHECKER "1" "July 2025" "kernel-hardening-checker" "User Commands"
2+
3+
.SH NAME
4+
kernel-hardening-checker \- tool for checking the security hardening options of the Linux kernel
5+
6+
.SH SYNOPSIS
7+
\fBkernel-hardening-checker\fR [\fIOPTIONS\fR]
8+
9+
.SH DESCRIPTION
10+
\fBkernel-hardening-checker\fR is a tool for checking the security hardening options of the Linux kernel.
11+
It can analyze Kconfig options (compile-time), kernel command line arguments (boot-time), and sysctl parameters (runtime)
12+
for the following architectures: X86_64, X86_32, ARM64, ARM, RISC-V.
13+
14+
Please note that changing the Linux kernel security parameters may also affect system performance
15+
and functionality of userspace software. Therefore, when setting these parameters, consider
16+
the threat model of your Linux-based information system and thoroughly test its typical workload.
17+
18+
.SH OPTIONS
19+
20+
.TP
21+
\fB\-h\fR, \fB\-\-help\fR
22+
Show the help message and exit.
23+
24+
.TP
25+
\fB\-\-version\fR
26+
Show program's version number and exit.
27+
28+
.TP
29+
\fB\-m\fR {verbose,json,show_ok,show_fail}, \fB\-\-mode\fR {verbose,json,show_ok,show_fail}
30+
Select a special output mode instead of the default one:
31+
.RS
32+
.IP \fBverbose\fR
33+
Provide additional information: print the configuration options without a corresponding check and show the internals of complex checks.
34+
.IP \fBjson\fR
35+
Report in JSON format.
36+
.IP \fBshow_ok\fR
37+
Show only successful checks.
38+
.IP \fBshow_fail\fR
39+
Show only failed checks.
40+
.RE
41+
42+
.TP
43+
\fB\-a\fR, \fB\-\-autodetect\fR
44+
Autodetect and check the security hardening options of the running kernel.
45+
46+
.TP
47+
\fB\-c\fR CONFIG, \fB\-\-config\fR CONFIG
48+
Check the security hardening options in a Kconfig file (also supports *.gz files).
49+
50+
.TP
51+
\fB\-v\fR KERNEL_VERSION, \fB\-\-kernel\-version\fR KERNEL_VERSION
52+
Extract the kernel version from a version file (such as /proc/version) instead of using a Kconfig file.
53+
54+
.TP
55+
\fB\-l\fR CMDLINE, \fB\-\-cmdline\fR CMDLINE
56+
Check the security hardening options in a kernel command line file (such as /proc/cmdline).
57+
58+
.TP
59+
\fB\-s\fR SYSCTL, \fB\-\-sysctl\fR SYSCTL
60+
Check the security hardening options in a sysctl output file (the result of "sudo sysctl -a > file").
61+
62+
.TP
63+
\fB\-p\fR {X86_64,X86_32,ARM64,ARM,RISCV}, \fB\-\-print\fR {X86_64,X86_32,ARM64,ARM,RISCV}
64+
Print security hardening recommendations for the selected architecture.
65+
66+
.TP
67+
\fB\-g\fR {X86_64,X86_32,ARM64,ARM,RISCV}, \fB\-\-generate\fR {X86_64,X86_32,ARM64,ARM,RISCV}
68+
Generate a Kconfig fragment containing the security hardening options for the selected architecture.
69+
70+
.SH AUTHOR
71+
Written by Alexander Popov with help from the contributors.
72+
73+
.SH REPORTING BUGS
74+
Report bugs at: <https://github.com/a13xp0p0v/kernel-hardening-checker/issues>
75+
76+
.SH COPYRIGHT
77+
Copyright: 2018-2025, Alexander Popov <[email protected]>
78+
.br
79+
License: GPL-3.0

0 commit comments

Comments
 (0)