leviathan
9593d90385
Breaking change. Tool name, binary name, function/type names,
constant names, env vars, header guards, file paths, and GitHub
repo URL all rebrand IAMROOT → SKELETONKEY.
Changes:
- All "IAMROOT" → "SKELETONKEY" (constants, env vars, enum
values, docs, comments)
- All "iamroot" → "skeletonkey" (functions, types, paths, CLI)
- iamroot.c → skeletonkey.c
- modules/*/iamroot_modules.{c,h} → modules/*/skeletonkey_modules.{c,h}
- tools/iamroot-fleet-scan.sh → tools/skeletonkey-fleet-scan.sh
- Binary "iamroot" → "skeletonkey"
- GitHub URL KaraZajac/IAMROOT → KaraZajac/SKELETONKEY
- .gitignore now expects build output named "skeletonkey"
- /tmp/iamroot-* tmpfiles → /tmp/skeletonkey-*
- Env vars IAMROOT_MODPROBE_PATH etc. → SKELETONKEY_*
New ASCII skeleton-key banner (horizontal key icon + ANSI Shadow
SKELETONKEY block letters) replaces the IAMROOT banner in
skeletonkey.c and README.md.
VERSION: 0.3.1 → 0.4.0 (breaking).
Build clean on Debian 6.12.86. `skeletonkey --version` → 0.4.0.
All 24 modules still register; no functional code changes — pure
rename + banner refresh.
60 lines
2.0 KiB
C
60 lines
2.0 KiB
C
/*
|
|
* SKELETONKEY — kernel version range matching
|
|
*
|
|
* Every CVE module needs to answer "is the host kernel in the affected
|
|
* range?". This file centralizes that.
|
|
*
|
|
* The kernel version space is a tree of stable branches: 5.10.x,
|
|
* 5.15.x, 5.16.x, ..., 6.6.x, 6.12.x, etc. A CVE is typically fixed
|
|
* in mainline at some version, then backported into one or more
|
|
* stable branches at branch-specific minor versions. A host with
|
|
* 5.15.50 is patched if the fix was backported to 5.15.42, but a
|
|
* host with 5.15.10 is still vulnerable.
|
|
*
|
|
* We model this with a list of "patched-from" entries per CVE: each
|
|
* entry says "on branch X.Y, the fix is in versions >= X.Y.Z". The
|
|
* host is patched if its branch matches one of these entries AND its
|
|
* patch version is at or above the threshold.
|
|
*/
|
|
|
|
#ifndef SKELETONKEY_KERNEL_RANGE_H
|
|
#define SKELETONKEY_KERNEL_RANGE_H
|
|
|
|
#include <stdbool.h>
|
|
#include <stddef.h>
|
|
|
|
struct kernel_version {
|
|
int major;
|
|
int minor;
|
|
int patch;
|
|
/* Original /proc/version-style release string (e.g. "6.12.88-generic")
|
|
* — for reporting; the comparison logic uses the parsed numerics. */
|
|
const char *release;
|
|
};
|
|
|
|
/* Per-branch "patched-from" entry. To say "fix is in mainline 5.17",
|
|
* use {5, 17, 0}. To say "fix backported to 5.15.25", use {5, 15, 25}. */
|
|
struct kernel_patched_from {
|
|
int major;
|
|
int minor;
|
|
int patch;
|
|
};
|
|
|
|
struct kernel_range {
|
|
/* List of branches that have the fix backported. If the host's
|
|
* (major, minor) matches a branch AND host.patch >= branch.patch,
|
|
* the host is patched. */
|
|
const struct kernel_patched_from *patched_from;
|
|
size_t n_patched_from;
|
|
};
|
|
|
|
/* Parse uname(2)->release / /proc/version into a kernel_version.
|
|
* Returns true on success. Stores nothing in `out` on failure. */
|
|
bool kernel_version_current(struct kernel_version *out);
|
|
|
|
/* Returns true if a host running `v` is PATCHED according to `r`. */
|
|
bool kernel_range_is_patched(const struct kernel_range *r,
|
|
const struct kernel_version *v);
|
|
|
|
#endif /* SKELETONKEY_KERNEL_RANGE_H */
|