Two setup scripts, one orchestrator (ksec) with five sub-commands, and a dynamic harness. All examples use a fictional /dev/foo driver — swap in your own target.
两个安装脚本、一个编排器（ksec，五个子命令）、一套动态 harness。所有示例用虚构的 /dev/foo 驱动——换成你自己的目标即可。
ksec report merges static, LLM and dynamic results.
装一次，之后每棵内核跑一遍。ksec report 合并静态、LLM、动态三层结果。
scripts/install-deps.sh
Detects your package manager (apt / dnf / yum / pacman / zypper) and installs everything the deterministic layer needs. System packages use sudo; pip tools install to --user (no sudo).
认出你的包管理器（apt / dnf / yum / pacman / zypper），装齐确定性层要用的东西。系统包走 sudo；pip 工具装到 --user（不用 sudo）。
| Installs装什么 | Which具体 | For给谁用 |
|---|---|---|
| system pkgs (sudo)系统包（sudo） | coccinelle · ripgrep · gcc-aarch64 · git · python3 · adb | cvehound · cross-compile交叉编译 |
| pip (--user)pip（--user） | cvehound · kernel-hardening-checker · semgrep | ① ② ⑤ |
| heavy (opt-in)重依赖（opt-in） | radare2 · Ghidra / syzkaller pointers/ syzkaller 指引 | ③ ⑥ |
--dry-run first if you want to review, or --no-sudo to skip system packages entirely.
关于 sudo：脚本在跑每条 sudo 命令前会先打印出来。想先审就用 --dry-run，或用 --no-sudo 完全跳过系统包。
scripts/clone-tools.sh
Reproducibly clones the 10 third-party tools into repos/. Their bytes are not tracked in git (see .gitignore) — this script rebuilds the tool tree on any machine.
可复现地把 10 个第三方工具克隆到 repos/。它们的字节不进 git（见 .gitignore）——这个脚本在任何机器上重建工具树。
| Cat类 | Tool工具 | Role作用 |
|---|---|---|
| ① | cvehound · kernel-cve-tool · linux_kernel_cves | known-CVE detection + data已知 CVE 检测 + 数据 |
| ② | kernel-hardening-checker | config hardening vs KSPP配置对照 KSPP 加固 |
| ③ | KernelGPT | LLM → syzkaller specsLLM 生成 syzkaller 规格 |
| ④ | linux-kernel-exploitation | impact-rating reference影响评级参考资料 |
| ⑤ | trailofbits/skills · claude-code-security-review | LLM C / diff auditLLM 审 C / diff |
| ⑥ | GhidraMCP · radare2-mcp | reverse-engineering via MCP经 MCP 逆向 |
bin/ksec
Pure Python 3 stdlib. Each scanner is an external CLI — if it's missing, ksec skips it and marks skipped in the report (skipped means not run, not "clean").
纯 Python 3 标准库。每个扫描器是外部 CLI——缺了就跳过，在报告里标 skipped（skipped 意思是没跑，不是"没问题"）。
| Command命令 | What it does做什么 |
|---|---|
ksec setup | pip-install scanners + run clone-tools + check system depspip 装扫描器 + 跑 clone-tools + 查系统依赖 |
ksec scan --kernel $KERNEL | run the L1 static checks (cvehound, hardening, optionally kernel-cve-tool)跑 L1 静态检查（cvehound、加固、可选 kernel-cve-tool） |
--config $KERNEL/.config | feed a full .config to the hardening checker给加固检查喂完整 .config |
--src <subdir> | semgrep a specific source subtree (e.g. one driver)用 semgrep 扫某个源码子目录（如某驱动） |
--with-cve-tool | also run kernel-cve-tool (needs git history + fetch, heavy)同时跑 kernel-cve-tool（需 git 历史 + fetch，重） |
ksec report [--html] | merge results into out/report.md (+ .html)合并结果成 out/report.md（+ .html） |
ksec audit --kernel $KERNEL | L2 entry: prints how to run /kernel-sec-audit in Claude CodeL2 入口：提示怎么在 Claude Code 里跑 /kernel-sec-audit |
ksec dynamic check | L3 preflight: adb / cross-compiler / syzkaller / kmemleakL3 前置检查：adb / 交叉编译器 / syzkaller / kmemleak |
ksec dynamic slabmon --adb … | run the slab-leak monitor with a probe (folds into report)配探针跑 slab 泄漏监控（并进报告） |
A skipped scanner means not run — never "clean". Read the reason, install what's missing, run again. 扫描器被跳过意思是没跑——绝不是"没问题"。读原因、补上缺的、再跑一遍。 ksec report
harness/ — leak probe + slabmon泄漏探针 + slab 监控Static checks can't see runtime leak rate. The harness re-runs one ioctl error path N times and watches whether kernel slab grows without bound — growth means a leak; flat after a fix means fixed. 静态查不出运行时泄漏率。harness 把某条 ioctl 错误路径反复跑 N 次，看内核 slab 是否无上限增长——增长 = 有泄漏；修复后变平 = 修好了。
Stronger automation: enable CONFIG_DEBUG_KMEMLEAK to have the kernel name the leak site directly, or drive syzkaller + KASAN to scan the whole class of ioctl cmds. See docs/03.
更强的自动化：开 CONFIG_DEBUG_KMEMLEAK 让内核直接点名泄漏点，或用 syzkaller + KASAN 扫整类 ioctl cmd。见 docs/03。
| # | Category类别 | How to run怎么跑 |
|---|---|---|
| ① | Known CVE已知 CVE | ksec scan → cvehound + kernel-cve-tool cross-check, LLM filters FPscvehound + kernel-cve-tool 交叉验证，LLM 过滤假阳性 |
| ② | Hardening配置加固 | feed full .config, read the FAIL list vs KSPP喂完整 .config，读对照 KSPP 的 FAIL 清单 |
| ③ | Discovery新洞挖掘 | KernelGPT specs → syzkaller + KASAN on a KCOV kernelKernelGPT 生规格 → syzkaller + KASAN 打带 KCOV 的内核 |
| ④ | Impact rating影响评级 | paper rating from the exploitation reference — reachability × impact用 exploitation 资料纸面定级——可达性 × 影响 |
| ⑤ | LLM auditLLM 审计 | /kernel-sec-audit → c-review · variant-analysis · entry-point-analyzer |
| ⑥ | Reverse逆向 | Ghidra + GhidraMCP → let Claude read the shipped .koGhidra + GhidraMCP → 让 Claude 读出厂 .ko |