mirror of
https://github.com/clearlinux/kernel-config-checker.git
synced 2026-08-27 17:06:02 +00:00
Arjan van de Ven
56 lines
2.2 KiB
Python
56 lines
2.2 KiB
Python
'''
|
|
Copyright (C) 2018 Intel Corporation
|
|
|
|
SPDX-License-Identifier: GPL-3.0
|
|
|
|
Scrape best known kernel config settings from the KSPP WiKi.
|
|
'''
|
|
|
|
import re
|
|
import urllib.request
|
|
from typing import Tuple, Dict
|
|
|
|
KSPP_URL = 'https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings'
|
|
|
|
def KernelSelfProtectionProject():
|
|
with urllib.request.urlopen(KSPP_URL) as f:
|
|
if f.code != 200:
|
|
raise ValueError('Failed to retrieve secure config options')
|
|
text = f.read().decode()
|
|
# Map id's from right before the <pre> tag to their contents
|
|
return kspp_gen_config(dict(zip(
|
|
[block.split('id=')[-1].split('"')[1].strip() \
|
|
for block in text.split('>\n<pre>')],
|
|
[block[:-2] for block in text.split('pre>') \
|
|
if block.endswith('</')])))
|
|
|
|
def kspp_gen_config(sections_and_configs: Dict[str, str]) \
|
|
-> Tuple[Dict[str, str], Dict[str, str], Dict[str, str]]:
|
|
must_be_set: Dict[str, str] = {}
|
|
must_be_set_or_module: Dict[str, str] = {}
|
|
must_be_unset: Dict[str, str] = {}
|
|
data = sections_and_configs['CONFIGs'] + sections_and_configs['x86_64']
|
|
lines = data.split('\n')
|
|
comment = 0
|
|
for i in range(0, len(lines)):
|
|
line = lines[i]
|
|
if line.startswith('#') \
|
|
and not line.startswith('# CONFIG_'):
|
|
comment = i
|
|
if i == comment:
|
|
continue
|
|
if 'is not set' in line:
|
|
opt = 'CONFIG_' + line.split('CONFIG_')[1].split()[0]
|
|
must_be_unset[opt] = lines[comment].replace('#', '').strip()
|
|
elif line.endswith('=y'):
|
|
opt = 'CONFIG_' + line.split('CONFIG_')[1].split('=')[0]
|
|
must_be_set[opt] = lines[comment].replace('#', '').strip()
|
|
elif line.endswith('=m'):
|
|
opt = 'CONFIG_' + line.split('CONFIG_')[1].split('=')[0]
|
|
must_be_set_or_module[opt] = lines[comment].replace('#',
|
|
'').strip()
|
|
# KSPP Recommends disabling modules. Which is not realistic.
|
|
if 'CONFIG_MODULES' in must_be_unset:
|
|
del must_be_unset['CONFIG_MODULES']
|
|
return must_be_set, must_be_set_or_module, must_be_unset
|