Let user select configs without absolute path about kernel-hardening-checker

[a13xp0p0v]

Hello @dmknght,

Thanks for writing!

Actually, the config files in kconfig_hardened_check/config_files/ are provided as examples that are used for developing and testing of this tool. These configs are updated not that often, they don't cover all major distros.

The main use case for users is to check their own kernel config. The example from Fedora:

./bin/kconfig-hardened-check -c /boot/config-5.16.11-100.fc34.x86_64

So I don't think users care about the location of these example config files. How do you think?

[dmknght]

Hello @dmknght,

Thanks for writing!

Actually, the config files in kconfig_hardened_check/config_files/ are provided as examples that are used for developing and testing of this tool. These configs are updated not that often, they don't cover all major distros.

The main use case for users is to check their own kernel config. The example from Fedora:

./bin/kconfig-hardened-check -c /boot/config-5.16.11-100.fc34.x86_64

So I don't think users care about the location of these example config files. How do you think?

Hello! Sorry for very late reply. I had issue with my mail notification LuL. Anyway, I think that's a very interesting point that i didn't know. In this case, I think kconfig-hardened-check can have a flag like auto check to do the command automatically. The workflow is like:

1. Check if there is config file that matches kernel version at /boot/
2. If exists, run the system check automatically
3. If doesn't exists, tells user to try some examples. In this case, i think absolute path of examples is needed.

What do you think about this? To me I think it's easier to user to just do run and read the result without thinking about wrong profiles.

[Bernhard40]

Some distros don't expose kernel config at /boot and I don't see why average user would be interested in checking example config which is probably totally unrelated to their system.

[a13xp0p0v]

I agree with @Bernhard40.

@dmknght, I would avoid adding the code for searching the kernel config on a local machine.

Moreover, Linux kernel developers often use the kconfig-hardened-check tool for the configs of the kernels that they develop (not the config of the local machine).

Thanks!

[dmknght]

@dmknght, I would avoid adding the code for searching the kernel config on a local machine.

Well it's not that hard. From what i checked, you just need to get kernel version, and map the path /boot/config-<kernel version>

Moreover, Linux kernel developers often use the kconfig-hardened-check tool for the configs of the kernels that they develop (not the config of the local machine).
Well i see. So i guess I can close the issue now because the scope is different.