#!/bin/sh

set -e

echo "starting kernel config sanity test with /proc/config.gz"

# decompress /proc/config.gz from the host
global UNZIPPED_CONFIG := $[zcat /proc/config.gz]

global kernelVersion := $[uname -r]
global kernelMajor := $(kernelVersion%%.*)
global kernelMinor := $(kernelVersion#$kernelMajor.)
global kernelMinor := $(kernelMinor%%.*)

# Most tests against https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
# Positive cases

echo $UNZIPPED_CONFIG | grep -q CONFIG_BUG=y || shell {echo "CONFIG_BUG=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_DEBUG_KERNEL=y || shell {echo "CONFIG_DEBUG_KERNEL=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_DEBUG_RODATA=y || shell {echo "CONFIG_DEBUG_RODATA=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_CC_STACKPROTECTOR=y || shell {echo "CONFIG_CC_STACKPROTECTOR=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_CC_STACKPROTECTOR_STRONG=y || shell {echo "CONFIG_CC_STACKPROTECTOR_STRONG=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_STRICT_DEVMEM=y || shell {echo "CONFIG_STRICT_DEVMEM=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_SYN_COOKIES=y || shell {echo "CONFIG_SYN_COOKIES=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_DEBUG_CREDENTIALS=y || shell {echo "CONFIG_DEBUG_CREDENTIALS=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_DEBUG_NOTIFIERS=y || shell {echo "CONFIG_DEBUG_NOTIFIERS=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_DEBUG_LIST=y || shell {echo "CONFIG_DEBUG_LIST=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_SECCOMP=y || shell {echo "CONFIG_SECCOMP=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_SECCOMP_FILTER=y || shell {echo "CONFIG_SECCOMP_FILTER=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_SECURITY=y || shell {echo "CONFIG_SECURITY=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_SECURITY_YAMA=y || shell {echo "CONFIG_SECURITY_YAMA=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_PANIC_ON_OOPS=y || shell {echo "CONFIG_PANIC_ON_OOPS=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_DEBUG_SET_MODULE_RONX=y || shell {echo "CONFIG_DEBUG_SET_MODULE_RONX=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_SYN_COOKIES=y || shell {echo "CONFIG_SYN_COOKIES=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_LEGACY_VSYSCALL_NONE=y || shell {echo "CONFIG_LEGACY_VSYSCALL_NONE=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_RANDOMIZE_BASE=y || shell {echo "CONFIG_RANDOMIZE_BASE=y" && exit 1}

# Conditional on kernel version
if test $kernelMajor -ge 4 -a $kernelMinor -ge 5 {
  echo $UNZIPPED_CONFIG | grep -q CONFIG_IO_STRICT_DEVMEM=y || shell {echo "CONFIG_IO_STRICT_DEVMEM=y" && exit 1}
  echo $UNZIPPED_CONFIG | grep -q CONFIG_UBSAN=y || shell {echo "CONFIG_UBSAN=y" && exit 1}
}
if test $kernelMajor -ge 4 -a $kernelMinor -ge 7 {
  echo $UNZIPPED_CONFIG | grep -q CONFIG_SLAB_FREELIST_RANDOM=y || shell {echo "CONFIG_SLAB_FREELIST_RANDOM=y" && exit 1}
}
if test $kernelMajor -ge 4 -a $kernelMinor -ge 8 {
  echo $UNZIPPED_CONFIG | grep -q CONFIG_HARDENED_USERCOPY=y || shell {echo "CONFIG_HARDENED_USERCOPY=y" && exit 1}
  echo $UNZIPPED_CONFIG | grep -q CONFIG_RANDOMIZE_MEMORY=y || shell {echo "CONFIG_RANDOMIZE_MEMORY=y" && exit 1}
}

# poisoning cannot be enabled in 4.4
if test $kernelMajor -ge 4 -a $kernelMinor -ge 9 {
  echo $UNZIPPED_CONFIG | grep -q CONFIG_PAGE_POISONING=y || shell {echo "CONFIG_PAGE_POISONING=y" && exit 1}
  echo $UNZIPPED_CONFIG | grep -q CONFIG_PAGE_POISONING_NO_SANITY=y || shell {echo "CONFIG_PAGE_POISONING_NO_SANITY=y" && exit 1}
  echo $UNZIPPED_CONFIG | grep -q CONFIG_PAGE_POISONING_ZERO=y || shell {echo "CONFIG_PAGE_POISONING_ZERO=y" && exit 1}
}

if test $kernelMajor -ge 4 -a $kernelMinor -ge 10 {
  echo $UNZIPPED_CONFIG | grep -q CONFIG_BUG_ON_DATA_CORRUPTION=y || shell {echo "CONFIG_BUG_ON_DATA_CORRUPTION=y" && exit 1}
}

# Negative cases
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_ACPI_CUSTOM_METHOD is not set' || shell {echo "CONFIG_ACPI_CUSTOM_METHOD is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_COMPAT_BRK is not set' || shell {echo "CONFIG_COMPAT_BRK is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_DEVKMEM is not set' || shell {echo "CONFIG_DEVKMEM is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_COMPAT_VDSO is not set' || shell {echo "CONFIG_COMPAT_VDSO is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_KEXEC is not set' || shell {echo "CONFIG_KEXEC is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_HIBERNATION is not set' || shell {echo "CONFIG_HIBERNATION is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_LEGACY_PTYS is not set' || shell {echo "CONFIG_LEGACY_PTYS is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_X86_X32 is not set' || shell {echo "CONFIG_X86_X32 is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_MODIFY_LDT_SYSCALL is not set' || shell {echo "CONFIG_MODIFY_LDT_SYSCALL is not set" && exit 1}

echo "kernel config test succeeded!"
(CommandList
  children: [
    (C {(set)} {(-e)})
    (C {(echo)} {(DQ ("starting kernel config sanity test with /proc/config.gz"))})
    (Assignment
      keyword: Assign_None
      pairs: [
        (assign_pair
          lhs: (LhsName name:UNZIPPED_CONFIG)
          op: Equal
          rhs: 
            {
              (CommandSubPart
                command_list: (CommandList children:[(C {(zcat)} {(/proc/config.gz)})])
                left_token: <Left_CommandSub "$(">
                spids: [20 24]
              )
            }
          spids: [19]
        )
      ]
      spids: [19]
    )
    (Assignment
      keyword: Assign_None
      pairs: [
        (assign_pair
          lhs: (LhsName name:kernelVersion)
          op: Equal
          rhs: 
            {
              (DQ 
                (CommandSubPart
                  command_list: (CommandList children:[(C {(uname)} {(-r)})])
                  left_token: <Left_CommandSub "$(">
                  spids: [29 33]
                )
              )
            }
          spids: [27]
        )
      ]
      spids: [27]
    )
    (Assignment
      keyword: Assign_None
      pairs: [
        (assign_pair
          lhs: (LhsName name:kernelMajor)
          op: Equal
          rhs: 
            {
              (DQ 
                (BracedVarSub
                  token: <VSub_Name kernelVersion>
                  suffix_op: (StringUnary op_id:VOp1_DPercent arg_word:{(".*")})
                  spids: [38 42]
                )
              )
            }
          spids: [36]
        )
      ]
      spids: [36]
    )
    (Assignment
      keyword: Assign_None
      pairs: [
        (assign_pair
          lhs: (LhsName name:kernelMinor)
          op: Equal
          rhs: 
            {
              (DQ 
                (BracedVarSub
                  token: <VSub_Name kernelVersion>
                  suffix_op: (StringUnary op_id:VOp1_Pound arg_word:{($ VSub_Name "$kernelMajor") (.)})
                  spids: [47 52]
                )
              )
            }
          spids: [45]
        )
      ]
      spids: [45]
    )
    (Assignment
      keyword: Assign_None
      pairs: [
        (assign_pair
          lhs: (LhsName name:kernelMinor)
          op: Equal
          rhs: 
            {
              (DQ 
                (BracedVarSub
                  token: <VSub_Name kernelMinor>
                  suffix_op: (StringUnary op_id:VOp1_DPercent arg_word:{(".*")})
                  spids: [57 61]
                )
              )
            }
          spids: [55]
        )
      ]
      spids: [55]
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_BUG=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_BUG=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [87 99]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_DEBUG_KERNEL=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_DEBUG_KERNEL=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [116 128]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_DEBUG_RODATA=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_DEBUG_RODATA=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [145 157]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_CC_STACKPROTECTOR=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_CC_STACKPROTECTOR=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [174 186]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_CC_STACKPROTECTOR_STRONG=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_CC_STACKPROTECTOR_STRONG=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [203 215]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_STRICT_DEVMEM=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_STRICT_DEVMEM=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [232 244]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_SYN_COOKIES=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_SYN_COOKIES=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [261 273]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_DEBUG_CREDENTIALS=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_DEBUG_CREDENTIALS=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [290 302]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_DEBUG_NOTIFIERS=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_DEBUG_NOTIFIERS=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [319 331]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_DEBUG_LIST=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_DEBUG_LIST=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [348 360]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_SECCOMP=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_SECCOMP=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [377 389]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_SECCOMP_FILTER=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_SECCOMP_FILTER=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [406 418]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_SECURITY=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_SECURITY=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [435 447]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_SECURITY_YAMA=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_SECURITY_YAMA=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [464 476]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_PANIC_ON_OOPS=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_PANIC_ON_OOPS=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [493 505]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_DEBUG_SET_MODULE_RONX=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_DEBUG_SET_MODULE_RONX=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [522 534]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_SYN_COOKIES=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_SYN_COOKIES=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [551 563]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_LEGACY_VSYSCALL_NONE=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_LEGACY_VSYSCALL_NONE=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [580 592]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_RANDOMIZE_BASE=") (y)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_RANDOMIZE_BASE=y"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [609 621]
        )
      ]
      op_id: Op_DPipe
    )
    (If
      arms: [
        (if_arm
          cond: [
            (Sentence
              child: 
                (C {(Lit_Other "[")} {(DQ ($ VSub_Name "$kernelMajor"))} {(-ge)} {(4)} {(-a)} 
                  {(DQ ($ VSub_Name "$kernelMinor"))} {(-ge)} {(5)} {(Lit_Other "]")}
                )
              terminator: <Op_Semi ";">
            )
          ]
          action: [
            (AndOr
              children: [
                (Pipeline
                  children: [
                    (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
                    (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_IO_STRICT_DEVMEM=") (y)})
                  ]
                  negated: False
                )
                (Subshell
                  child: 
                    (AndOr
                      children: [(C {(echo)} {(DQ ("CONFIG_IO_STRICT_DEVMEM=y"))}) (C {(exit)} {(1)})]
                      op_id: Op_DAmp
                    )
                  spids: [670 682]
                )
              ]
              op_id: Op_DPipe
            )
            (AndOr
              children: [
                (Pipeline
                  children: [
                    (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
                    (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_UBSAN=") (y)})
                  ]
                  negated: False
                )
                (Subshell
                  child: 
                    (AndOr
                      children: [(C {(echo)} {(DQ ("CONFIG_UBSAN=y"))}) (C {(exit)} {(1)})]
                      op_id: Op_DAmp
                    )
                  spids: [700 712]
                )
              ]
              op_id: Op_DPipe
            )
          ]
          spids: [-1 652]
        )
      ]
      spids: [-1 714]
    )
    (If
      arms: [
        (if_arm
          cond: [
            (Sentence
              child: 
                (C {(Lit_Other "[")} {(DQ ($ VSub_Name "$kernelMajor"))} {(-ge)} {(4)} {(-a)} 
                  {(DQ ($ VSub_Name "$kernelMinor"))} {(-ge)} {(7)} {(Lit_Other "]")}
                )
              terminator: <Op_Semi ";">
            )
          ]
          action: [
            (AndOr
              children: [
                (Pipeline
                  children: [
                    (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
                    (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_SLAB_FREELIST_RANDOM=") (y)})
                  ]
                  negated: False
                )
                (Subshell
                  child: 
                    (AndOr
                      children: [
                        (C {(echo)} {(DQ ("CONFIG_SLAB_FREELIST_RANDOM=y"))})
                        (C {(exit)} {(1)})
                      ]
                      op_id: Op_DAmp
                    )
                  spids: [759 771]
                )
              ]
              op_id: Op_DPipe
            )
          ]
          spids: [-1 741]
        )
      ]
      spids: [-1 773]
    )
    (If
      arms: [
        (if_arm
          cond: [
            (Sentence
              child: 
                (C {(Lit_Other "[")} {(DQ ($ VSub_Name "$kernelMajor"))} {(-ge)} {(4)} {(-a)} 
                  {(DQ ($ VSub_Name "$kernelMinor"))} {(-ge)} {(8)} {(Lit_Other "]")}
                )
              terminator: <Op_Semi ";">
            )
          ]
          action: [
            (AndOr
              children: [
                (Pipeline
                  children: [
                    (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
                    (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_HARDENED_USERCOPY=") (y)})
                  ]
                  negated: False
                )
                (Subshell
                  child: 
                    (AndOr
                      children: [(C {(echo)} {(DQ ("CONFIG_HARDENED_USERCOPY=y"))}) (C {(exit)} {(1)})]
                      op_id: Op_DAmp
                    )
                  spids: [818 830]
                )
              ]
              op_id: Op_DPipe
            )
            (AndOr
              children: [
                (Pipeline
                  children: [
                    (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
                    (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_RANDOMIZE_MEMORY=") (y)})
                  ]
                  negated: False
                )
                (Subshell
                  child: 
                    (AndOr
                      children: [(C {(echo)} {(DQ ("CONFIG_RANDOMIZE_MEMORY=y"))}) (C {(exit)} {(1)})]
                      op_id: Op_DAmp
                    )
                  spids: [848 860]
                )
              ]
              op_id: Op_DPipe
            )
          ]
          spids: [-1 800]
        )
      ]
      spids: [-1 862]
    )
    (If
      arms: [
        (if_arm
          cond: [
            (Sentence
              child: 
                (C {(Lit_Other "[")} {(DQ ($ VSub_Name "$kernelMajor"))} {(-ge)} {(4)} {(-a)} 
                  {(DQ ($ VSub_Name "$kernelMinor"))} {(-ge)} {(9)} {(Lit_Other "]")}
                )
              terminator: <Op_Semi ";">
            )
          ]
          action: [
            (AndOr
              children: [
                (Pipeline
                  children: [
                    (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
                    (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_PAGE_POISONING=") (y)})
                  ]
                  negated: False
                )
                (Subshell
                  child: 
                    (AndOr
                      children: [(C {(echo)} {(DQ ("CONFIG_PAGE_POISONING=y"))}) (C {(exit)} {(1)})]
                      op_id: Op_DAmp
                    )
                  spids: [911 923]
                )
              ]
              op_id: Op_DPipe
            )
            (AndOr
              children: [
                (Pipeline
                  children: [
                    (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
                    (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_PAGE_POISONING_NO_SANITY=") (y)})
                  ]
                  negated: False
                )
                (Subshell
                  child: 
                    (AndOr
                      children: [
                        (C {(echo)} {(DQ ("CONFIG_PAGE_POISONING_NO_SANITY=y"))})
                        (C {(exit)} {(1)})
                      ]
                      op_id: Op_DAmp
                    )
                  spids: [941 953]
                )
              ]
              op_id: Op_DPipe
            )
            (AndOr
              children: [
                (Pipeline
                  children: [
                    (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
                    (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_PAGE_POISONING_ZERO=") (y)})
                  ]
                  negated: False
                )
                (Subshell
                  child: 
                    (AndOr
                      children: [(C {(echo)} {(DQ ("CONFIG_PAGE_POISONING_ZERO=y"))}) (C {(exit)} {(1)})]
                      op_id: Op_DAmp
                    )
                  spids: [971 983]
                )
              ]
              op_id: Op_DPipe
            )
          ]
          spids: [-1 893]
        )
      ]
      spids: [-1 985]
    )
    (If
      arms: [
        (if_arm
          cond: [
            (Sentence
              child: 
                (C {(Lit_Other "[")} {(DQ ($ VSub_Name "$kernelMajor"))} {(-ge)} {(4)} {(-a)} 
                  {(DQ ($ VSub_Name "$kernelMinor"))} {(-ge)} {(10)} {(Lit_Other "]")}
                )
              terminator: <Op_Semi ";">
            )
          ]
          action: [
            (AndOr
              children: [
                (Pipeline
                  children: [
                    (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
                    (C {(grep)} {(-q)} {(Lit_VarLike "CONFIG_BUG_ON_DATA_CORRUPTION=") (y)})
                  ]
                  negated: False
                )
                (Subshell
                  child: 
                    (AndOr
                      children: [
                        (C {(echo)} {(DQ ("CONFIG_BUG_ON_DATA_CORRUPTION=y"))})
                        (C {(exit)} {(1)})
                      ]
                      op_id: Op_DAmp
                    )
                  spids: [1031 1043]
                )
              ]
              op_id: Op_DPipe
            )
          ]
          spids: [-1 1013]
        )
      ]
      spids: [-1 1045]
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(SQ <"CONFIG_ACPI_CUSTOM_METHOD is not set">)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_ACPI_CUSTOM_METHOD is not set"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [1067 1079]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(SQ <"CONFIG_COMPAT_BRK is not set">)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_COMPAT_BRK is not set"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [1097 1109]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(SQ <"CONFIG_DEVKMEM is not set">)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_DEVKMEM is not set"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [1127 1139]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(SQ <"CONFIG_COMPAT_VDSO is not set">)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_COMPAT_VDSO is not set"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [1157 1169]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(SQ <"CONFIG_KEXEC is not set">)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_KEXEC is not set"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [1187 1199]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(SQ <"CONFIG_HIBERNATION is not set">)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_HIBERNATION is not set"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [1217 1229]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(SQ <"CONFIG_LEGACY_PTYS is not set">)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_LEGACY_PTYS is not set"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [1247 1259]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(SQ <"CONFIG_X86_X32 is not set">)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_X86_X32 is not set"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [1277 1289]
        )
      ]
      op_id: Op_DPipe
    )
    (AndOr
      children: [
        (Pipeline
          children: [
            (C {(echo)} {($ VSub_Name "$UNZIPPED_CONFIG")})
            (C {(grep)} {(-q)} {(SQ <"CONFIG_MODIFY_LDT_SYSCALL is not set">)})
          ]
          negated: False
        )
        (Subshell
          child: 
            (AndOr
              children: [(C {(echo)} {(DQ ("CONFIG_MODIFY_LDT_SYSCALL is not set"))}) (C {(exit)} {(1)})]
              op_id: Op_DAmp
            )
          spids: [1307 1319]
        )
      ]
      op_id: Op_DPipe
    )
    (C {(echo)} {(DQ ("kernel config test succeeded!"))})
  ]
)