https://github.com/travier/kernel-config-checker

Kernel config checker, mainly used for compliance checks
https://github.com/travier/kernel-config-checker

Last synced: about 2 months ago
JSON representation

Kernel config checker, mainly used for compliance checks

• Host: GitHub
• URL: https://github.com/travier/kernel-config-checker
• Owner: travier
• License: mit
• Created: 2022-11-25T11:09:09.000Z (about 2 years ago)
• Default Branch: main
• Last Pushed: 2023-02-20T19:51:22.000Z (almost 2 years ago)
• Last Synced: 2024-11-29T17:50:56.519Z (about 2 months ago)
• Language: Go
• Homepage:
• Size: 127 KB
• Stars: 2
• Watchers: 4
• Forks: 1
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# Kernel config checker

Checks that options in a given kernel config match a list of expected values.

This is usefull to check for compliance, for example with the

[ANSSI-BP-028 v2.0 profile](https://www.ssi.gouv.fr/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/).

See also the

[OpenSCAP profiles](https://www.open-scap.org/security-policies/choosing-policy/)

for the rest of the system configuration.

## How to

1. Download a kernel config:

```

# Example from:

# CentOS Stream: https://gitlab.com/redhat/centos-stream/rpms/kernel

# Fedora: https://src.fedoraproject.org/rpms/kernel

$ curl -O https://gitlab.com/redhat/centos-stream/rpms/kernel/-/raw/c9s/kernel-x86_64-rhel.config

$ curl -O https://gitlab.com/redhat/centos-stream/rpms/kernel/-/raw/c9s/kernel-aarch64-rhel.config

$ curl -O https://src.fedoraproject.org/rpms/kernel/raw/f37/f/kernel-x86_64-fedora.config

$ curl -O https://src.fedoraproject.org/rpms/kernel/raw/f37/f/kernel-aarch64-fedora.config

```

2. Match them with a config profile:

```

$ go run main.go \

    -config examples/c9s/kernel-x86_64-rhel.config,examples/c9s/kernel-aarch64-rhel.config \

    -profile profiles/ANSSI-BP-028 \

    > results.csv

...

```

## Interpreting results

Note that it's extremely unlikely that you will have all config options set as

recommended as some options are so strict that they are impractical in most

cases (see `CONFIG_MODULES is not set` for example).

## TODO

- Validate sysctls too

- Add ideas from