Fabre

#1108225 RFS: kernel-hardening-checker/0.6.10.1-1 [ITP] -- Tool for checking Linux kernel security hardening options #1108225

Package:: sponsorship-requests

Source:: sponsorship-requests

Submitter:: Kirill Rekhov

Date:: 2025-07-09 17:05:01 UTC

Severity:: normal

Tags:

#1108225#5

Date:: 2025-06-23 15:53:04 UTC

From:

To:

Dear mentors,

I am looking for a sponsor for my package "kernel-hardening-checker":

 * Package name: kernel-hardening-checker
   Version: 0.6.10.1-1
   Upstream contact: Alexander Popov <alex.popov@linux.com>
 * URL: https://github.com/a13xp0p0v/kernel-hardening-checker
 * License: GPL-3
 * Vcs: https://salsa.debian.org/krekhov/kernel-hardening-checker
   Section: admin

The source builds the following binary packages:

  kernel-hardening-checker - Tool for checking Linux kernel security
hardening options

To access further information about this package, please visit the
following URL:

https://mentors.debian.net/package/kernel-hardening-checker/

Alternatively, you can download the package with 'dget' using this command:

  dget -x
https://mentors.debian.net/debian/pool/main/k/kernel-hardening-checker/kernel-hardening-checker_0.6.10.1-1.dsc

Changes for the initial release:

 kernel-hardening-checker (0.6.10.1-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1108174)

Regards,
--
  Kirill Rekhov

#1108225#10

Date:: 2025-06-24 00:03:47 UTC

From:

To:

Kirill,

Review of upload: 2025-06-23 15:42

For information about the tests run, see:

https://wiki.debian.org/PhilWyett/DebianMentoring

Test 6 (debian/watch): Information only

philwyett@ks-tarkin:~/Development/builder/debian/kernel-hardening-checker-
0.6.10.1$ uscan --dehs
<dehs>
Newest version of kernel-hardening-checker on remote site is 2024.01.24, local
version is 0.6.10.1
 => Newer package available from:
        =>
https://github.com/vimwiki/vimwiki/archive/refs/tags/v2024.01.24.tar.gz
Successfully renamed ../v2024.01.24.tar.gz to ../kernel-hardening-
checker_2024.01.24.orig.tar.gz.
<package>kernel-hardening-checker</package>
<debian-uversion>0.6.10.1</debian-uversion>
<debian-mangled-uversion>0.6.10.1</debian-mangled-uversion>
<upstream-version>2024.01.24</upstream-version>
<upstream-
url>https://github.com/vimwiki/vimwiki/archive/refs/tags/v2024.01.24.tar.gz</ups
tream-url>
<status>newer package available</status>
<target>kernel-hardening-checker_2024.01.24.orig.tar.gz</target>
<target-path>../kernel-hardening-checker_2024.01.24.orig.tar.gz</target-path>
<messages>Successfully downloaded upstream package: v2024.01.24.tar.gz

</messages>
</dehs>

Summary
=======

We seem to looking for vimwiki upstream packages rather tha the correct ones. I
see a copy and paste here that was not edited to correct settings. :-)

#1108225#15

Date:: 2025-06-24 00:03:47 UTC

From:

To:

Kirill,

Review of upload: 2025-06-23 15:42

For information about the tests run, see:

https://wiki.debian.org/PhilWyett/DebianMentoring

Test 6 (debian/watch): Information only

philwyett@ks-tarkin:~/Development/builder/debian/kernel-hardening-checker-
0.6.10.1$ uscan --dehs
<dehs>
Newest version of kernel-hardening-checker on remote site is 2024.01.24, local
version is 0.6.10.1
 => Newer package available from:
        =>
https://github.com/vimwiki/vimwiki/archive/refs/tags/v2024.01.24.tar.gz
Successfully renamed ../v2024.01.24.tar.gz to ../kernel-hardening-
checker_2024.01.24.orig.tar.gz.
<package>kernel-hardening-checker</package>
<debian-uversion>0.6.10.1</debian-uversion>
<debian-mangled-uversion>0.6.10.1</debian-mangled-uversion>
<upstream-version>2024.01.24</upstream-version>
<upstream-
url>https://github.com/vimwiki/vimwiki/archive/refs/tags/v2024.01.24.tar.gz</ups
tream-url>
<status>newer package available</status>
<target>kernel-hardening-checker_2024.01.24.orig.tar.gz</target>
<target-path>../kernel-hardening-checker_2024.01.24.orig.tar.gz</target-path>
<messages>Successfully downloaded upstream package: v2024.01.24.tar.gz

</messages>
</dehs>

Summary
=======

We seem to looking for vimwiki upstream packages rather tha the correct ones. I
see a copy and paste here that was not edited to correct settings. :-)

#1108225#20

Date:: 2025-06-25 11:47:18 UTC

From:

To:

Phil,

yes, thanks for noticing, it was funny =)
---
Regards, Kirill Rekhov

GPG Fingerprint:
2640 769D FDA1 AAA0 F863  D1AE 5F2C 5905 519C E0A0

#1108225#27

Date:: 2025-06-25 18:07:47 UTC

From:

To:

Kirill,

Review of upload: 2025-06-25 11:42

For information about the tests run, see:

https://wiki.debian.org/PhilWyett/DebianMentoring

Note: If test line removed, it indicates a test pass.

Summary
=======

Looks great now. Many thanks for the prompt response.

Tagging as 'confirmed'.

Hope a DD will find time soon to review and possibly upload.

#1108225#32

Date:: 2025-06-25 18:07:47 UTC

From:

To:

Kirill,

Review of upload: 2025-06-25 11:42

For information about the tests run, see:

https://wiki.debian.org/PhilWyett/DebianMentoring

Note: If test line removed, it indicates a test pass.

Summary
=======

Looks great now. Many thanks for the prompt response.

Tagging as 'confirmed'.

Hope a DD will find time soon to review and possibly upload.

#1108225#39

Date:: 2025-07-08 17:52:51 UTC

From:

To:

Hello,

thanks for packaging this.

I was going to upload but when trying it I couldn't really get it to work:

$ kernel-hardening-checker --mode verbose -a
[+] Special report mode: verbose
[+] Going to autodetect and check the security hardening options of the
running kernel
[-] ERROR: parsing /proc/version failed: failed to parse the version
"6.12.35+deb13-amd64"

Is this normal?

Am I doing something wrong?

Perhaps you want to add some examples of usage in the manpage before we upload
it?

#1108225#44

Date:: 2025-07-09 14:12:55 UTC

From:

To:

Hi, Salvo

Yes, we added man with upstream author, in version 0.6.10.2-1 you can do:
$ man kernel-hardening-checker
you are doing everything right, this command works for me:
$ sudo kernel-hardening-checker --mode verbose -a
[+] Special report mode: verbose
[+] Going to autodetect and check the security hardening options of the
running kernel
[+] Detected version of the running kernel: (6, 1, 0)
[+] Detected kconfig file of the running kernel: /boot/config-6.1.0-32-amd64
[+] Detected cmdline parameters of the running kernel: /proc/cmdline
[+] Saved sysctls to a temporary file /tmp/sysctl-pyrxvnl5
[+] Detected architecture: X86_64
[+] Detected compiler: GCC 120200
[?] No check for kconfig option CONFIG_CC_VERSION_TEXT ("gcc-12 (Debian
12.2.0-14) 12.2.0")
[?] No check for kconfig option CONFIG_GCC_VERSION (120200)
[?] No check for kconfig option CONFIG_CLANG_VERSION (0)
[?] No check for kconfig option CONFIG_AS_IS_GNU (y)
[?] No check for kconfig option CONFIG_AS_VERSION (24000)
[?] No check for kconfig option CONFIG_LD_IS_BFD (y)
...

but for some reason it doesn't work for you and I don't know why, you can
refer
to https://github.com/a13xp0p0v/kernel-hardening-checker/issues
---
Regards, Kirill Rekhov

GPG Fingerprint:
2640 769D FDA1 AAA0 F863  D1AE 5F2C 5905 519C E0A0

вт, 8 июл. 2025 г. в 20:52, Salvo Tomaselli <tiposchi@tiscali.it>:

#1108225#51

Date:: 2025-07-09 16:05:00 UTC

From:

To:

Hello,

well I have a completely default debian installed kernel so if it fails with
debian kernels perhaps it needs some more work before being in debian?

You could try with a sid vm in qemu maybe…

In data mercoledì 9 luglio 2025 16:12:55 Ora legale dell’Europa centrale,
Kirill Rekhov ha scritto:

#1108225#56

Date:: 2025-07-09 17:02:42 UTC

From:

To:

  A quick guess is that the change to include "+deb13" in the kernel
version is what's causing the breakage:
https://salsa.debian.org/kernel-team/linux/-/merge_requests/1524

Mathias

#1108225 RFS: kernel-hardening-checker/0.6.10.1-1 [ITP] -- Tool for checking Linux kernel security hardening options #1108225

Just Reply to ...

Reply to submitter ...

Send control command (Silently)

Set Architecture Tags (Silently)