security: run kconfig for each /boot/config- file

Author: Wenzel

hooks/security.py

@@ -25,6 +25,7 @@ def __init__(self, parameters):
         self.kconfig = str(self.KCONFIG_BIN)
 
         self.context.subscribe('filesystem_new_file_mime', self.check_file)
+        self.context.subscribe('filesystem_new_file', self.kconfig_check)
 
     def check_file(self, event):
         filepath = event.filepath
@@ -51,3 +52,11 @@ def str2bool(string):
             inode.fortify_source = str2bool(profile['fortify_source'])
             inode.fortified = profile['fortified']
             inode.fortifyable = profile['fortify-able']
+
+    def kconfig_check(self, event):
+        filepath = event.guest_filepath
+        inode = event.inode
+        if re.match(r'/boot/config-.*', filepath):
+            # run kconfig-hardened-check
+            cmdline = [self.kconfig, '--config', filepath, '--json']
+            kconfig_data = json.loads(subprocess.check_output(cmdline).decode())