/usr/bin/kernel-hardening-checker

usage: kernel-hardening-checker [-h] [--version] [-m {verbose,json,show_ok,show_fail}] [-a]
                                [-c CONFIG] [-v KERNEL_VERSION] [-l CMDLINE] [-s SYSCTL]
                                [-p {X86_64,X86_32,ARM64,ARM,RISCV}]
                                [-g {X86_64,X86_32,ARM64,ARM,RISCV}]

A tool for checking the security hardening options of the Linux kernel

options:
  -h, --help            show this help message and exit
  --version             show program's version number and exit
  -m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}
                        select a special output mode instead of the default one
  -a, --autodetect      autodetect and check the security hardening options of the running kernel
  -c CONFIG, --config CONFIG
                        check the security hardening options in a Kconfig file (also supports *.gz
                        files)
  -v KERNEL_VERSION, --kernel-version KERNEL_VERSION
                        extract the kernel version from a version file (such as /proc/version)
                        instead of using a Kconfig file
  -l CMDLINE, --cmdline CMDLINE
                        check the security hardening options in a kernel command line file (such
                        as /proc/cmdline)
  -s SYSCTL, --sysctl SYSCTL
                        check the security hardening options in a sysctl output file (the result
                        of "sudo sysctl -a > file")
  -p {X86_64,X86_32,ARM64,ARM,RISCV}, --print {X86_64,X86_32,ARM64,ARM,RISCV}
                        print security hardening recommendations for the selected architecture
  -g {X86_64,X86_32,ARM64,ARM,RISCV}, --generate {X86_64,X86_32,ARM64,ARM,RISCV}
                        generate a Kconfig fragment containing the security hardening options for
                        the selected architecture