kernel hardening checker update

[avnik]

Description of changes

KHC tool is fast evolving, and bumping hash manually each time is inconvenient.
I propose using flake.nix/lock for managing kernel-hardening-checker version pinning.

Checklist for things done

• Summary of the proposed changes in the PR description
• More detailed description in the commit message(s)
• Commits are squashed into relevant entities - avoid a lot of minimal dev time commits in the PR
• Contribution guidelines followed
• Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
• PR linked to architecture documentation and requirement(s) (ticket id)
• Test procedure described (or includes tests). Select one or more:
  • Tested on Lenovo X1 x86_64
  • Tested on Jetson Orin NX or AGX aarch64
  • Tested on Polarfire riscv64
• Author has run nix flake check --accept-flake-config and it passes
• All automatic Github Action checks pass - see actions
• Author has added reviewers and removed PR draft status

Testing

kernel-hardening-checker --version show newer version, also checker works on our baseline config

[vilvo]

In general, this is a good idea. I propose we look at this again after #439 is merged and extend the hardened kernel module tests here to cover also the kernel-hardening-checker testing. Even if just run for the merged, hardened kernel configuration. That way we will find possible regression in the kernel-hardening-checker. If we only update the tool, we won't notice the regression.

[Mic92]

Suggestion for a future PR: Could be also integrated into the CI/flake.nix like this:

{
  checks.kernel-hardening-check = runCommand "kernel-hardening-check" {} ''
    ${lib.getExe pkgs.kernel-hardening-checker} -c ${pkgs.hardened-kernel.configfile}
  '';
}

[Mic92]

Where the hardened-kernel is the attribute of this PR: #439

[avnik]

We have plan for it -- make json report from KHC, then use custom script to assert checks (because KHC asserts on too much things, we need to ignore some checks like CONFIG_MODULE)

[mikatammi]

Couldn't you simply make some script/tool to update the hash in the package file? I know there are even ready-made ones

[Mic92]

That would also works. Shameless self-plug: https://github.com/Mic92/nix-update/ has support for flakes... Someone also made a github action: https://github.com/marketplace/actions/nix-update-action
flake inputs probably require less code than that. They might create more noise in the lock files of consumers of this flake though.