tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-27 07:34:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug for 4.5

Browse Source
This commit is contained in:
Samson-W 2018-11-21 15:07:57 -05:00
parent f5f0aab2b1
commit 068e40b68a
2 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
bin/hardening/4.5_enable_apparmor.sh
View File

@ -15,7 +15,9 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=3 HARDENING_LEVEL=3
PACKAGES='apparmor apparmor-profiles apparmor-utils' PACKAGES='apparmor apparmor-profiles apparmor-utils'
GRUBPATTERN="GRUB_CMDLINE_LINUX=\"apparmor=1[[:space:]]*security=apparmor\"" KEYWORD="GRUB_CMDLINE_LINUX"
PATTERN="apparmor=1[[:space:]]*security=apparmor"
SETSTRING="apparmor=1 security=apparmor"
GRUBFILE='/etc/default/grub' GRUBFILE='/etc/default/grub'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
@ -26,14 +28,14 @@ audit () {
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
crit "$PACKAGE is absent!" crit "$PACKAGE is absent!"
FNRET=1 FNRET=1
exit 1
fi fi
done done
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
if [ $(grep ${GRUBPATTERN} ${GRUBFILE} | wc -l) -eq 1 ]; then if [ $( grep -w "^${KEYWORD}" ${GRUBFILE} | grep -c ${PATTERN}) -eq 1 ]; then
ok "There are apparmor=1 and security=apparmor to GRUB_CMDLINE_LINUX in /etc/default/grub" ok "There are ${SETSTRING} to ${KEYWORD} in ${GRUBFILE}"
if [ $(apparmor_status | grep 'profiles are loaded' | awk '{print $1}') -eq 0 ]; then is_mounted "/sys/kernel/security"
if [ ${FNRET} -eq 0 -a $(/usr/sbin/apparmor_status | grep 'profiles are loaded' | awk '{print $1}') -eq 0 ]; then
crit "AppArmor profiles not enable in the system " crit "AppArmor profiles not enable in the system "
FNRET=3 FNRET=3
else else
@ -41,12 +43,10 @@ audit () {
FNRET=0 FNRET=0
fi fi
else else
crit "There are not apparmor=1 and security=apparmor to GRUB_CMDLINE_LINUX in /etc/default/grub" crit "There are ${SETSTRING} to ${KEYWORD} in ${GRUBFILE}"
FNRET=2 FNRET=2
fi fi
fi fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
@ -60,13 +60,13 @@ apply () {
apt_install $PACKAGE apt_install $PACKAGE
done done
elif [ $FNRET = 2 ]; then elif [ $FNRET = 2 ]; then
warn "Set apparmor=1 and security=apparmor to GRUB_CMDLINE_LINUX in /etc/default/grub" warn "Set ${SETSTRING} to ${GRUBFILE} in ${GRUBFILE}, need reboot the system and enable AppArmor profiles after set it."
replace_in_file ${GRUBFILE} "^GRUB_CMDLINE_LINUX=.*" "" "${GRUBPATTERN}" sed -ie "s;\(${KEYWORD}=\)\(\".*\)\(\"\);\1\2 ${SETSTRING}\3;" ${GRUBFILE}
/usr/sbin/update-grub2
elif [ $FNRET = 3 ]; then elif [ $FNRET = 3 ]; then
warn "Enable AppArmor profiles in the system " warn "Enable AppArmor profiles in the system "
aa-enforce /etc/apparmor.d/* /usr/sbin/aa-enforce /etc/apparmor.d/*
fi fi
:
} }
# This function will check config parameters required # This function will check config parameters required

1
lib/utils.sh
View File

@ -150,6 +150,7 @@ add_line_file_after_pattern() {
} }
replace_in_file() { replace_in_file() {
set -x
local FILE=$1 local FILE=$1
local SOURCE=$2 local SOURCE=$2
local DESTINATION=$3 local DESTINATION=$3