Re: [RFC cip-dev][isar-cip-core][PATCH 02/14] Add cip-cis-rules-config to configure the hardening according to CIS

On 24.07.26 14:39, Quirin Gylstorff wrote:
> From: Quirin Gylstorff <[email protected]>
> 
> The `cip-cis-rules-config` recipe allows to create a use-case specific
> hardening configuration based on the CIS hardening rules.
> 
> To tailor a hardening config the command `bitbake -c menuconfig cip-cis-rules`
> can be used to generate the hardening config interactively.
> 
> After the package build the generated config can be found at
> `${DEPLOYDIR_HARDENING}/${CIP_CIS_HARDENING_CONFIG}`.
> 
> The package also provides a kernel config snippet
> `${DEPLOYDIR_HARDENING}/${CIP_CIS_HARDENING_KCONFIG}`, which can be used

KCONFIG is not Kconfig in this context, is it? If it is rather some
"harden-me.cfg" for consumption by the kernel build, then maybe rather
CIP_CIS_HANDENING_KERNEL_CFG?

BTW, do we need/want to prefix all vars with "CIP_"? What makes them
CIP-specific?

> to apply kernel hardening during compile instead of a runtime
> configuration.
> 
> Co-Authored-by: Clara Kowalsky <[email protected]>
> Co-Authored-by: Felix Moessbauer <[email protected]>
> Co-Authored-by: Christoph Steiger <[email protected]>
> Signed-off-by: Quirin Gylstorff <[email protected]>
> ---
>  .../cip-cis-rules-config.bb                   |   65 +
>  .../cip-cis-rules-config/files/.config.json   | 1759 ++++++++++
>  .../cip-cis-rules-config/files/Kconfig        | 2831 +++++++++++++++++
>  .../files/scripts/config.schema.json          |  124 +
>  .../files/scripts/gen-kernel-config.py        |  164 +
>  .../files/scripts/select-hardenings.py        |  618 ++++
>  .../cis-hardening/cis-hardening-to-kconfig.py |  348 ++
>  7 files changed, 5909 insertions(+)
>  create mode 100644 recipes-security/cip-cis-rules-config/cip-cis-rules-config.bb
>  create mode 100644 recipes-security/cip-cis-rules-config/files/.config.json

Is this a generic .config.json? It's leading "." suggests that it is
local file that should not be checked in.

>  create mode 100644 recipes-security/cip-cis-rules-config/files/Kconfig

Is this Kconfig...

>  create mode 100644 recipes-security/cip-cis-rules-config/files/scripts/config.schema.json
>  create mode 100755 recipes-security/cip-cis-rules-config/files/scripts/gen-kernel-config.py
>  create mode 100755 recipes-security/cip-cis-rules-config/files/scripts/select-hardenings.py
>  create mode 100755 scripts/cis-hardening/cis-hardening-to-kconfig.py

...from this script? If so, why do we need to check in that Kconfig file
above?

It feels like this series lacks a bit more architectural description.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center