tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-27 07:34:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug for 4.5

Browse Source
This commit is contained in:
Samson-W 2018-11-21 15:07:57 -05:00
parent f5f0aab2b1
commit 068e40b68a
2 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
bin/hardening/4.5_enable_apparmor.sh
View File

@ -15,7 +15,9 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=3
PACKAGES='apparmor apparmor-profiles apparmor-utils'
GRUBPATTERN="GRUB_CMDLINE_LINUX=\"apparmor=1[[:space:]]*security=apparmor\""
KEYWORD="GRUB_CMDLINE_LINUX"
PATTERN="apparmor=1[[:space:]]*security=apparmor"
SETSTRING="apparmor=1 security=apparmor"
GRUBFILE='/etc/default/grub'
# This function will be called if the script status is on enabled / audit mode
@ -26,14 +28,14 @@ audit () {
if [ $FNRET != 0 ]; then
crit "$PACKAGE is absent!"
FNRET=1
exit 1
fi
done
if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed"
if [ $(grep ${GRUBPATTERN} ${GRUBFILE} | wc -l) -eq 1 ]; then
ok "There are apparmor=1 and security=apparmor to GRUB_CMDLINE_LINUX in /etc/default/grub"
if [ $(apparmor_status | grep 'profiles are loaded' | awk '{print $1}') -eq 0 ]; then
if [ $( grep -w "^${KEYWORD}" ${GRUBFILE} | grep -c ${PATTERN}) -eq 1 ]; then
ok "There are ${SETSTRING} to ${KEYWORD} in ${GRUBFILE}"
is_mounted "/sys/kernel/security"
if [ ${FNRET} -eq 0 -a $(/usr/sbin/apparmor_status | grep 'profiles are loaded' | awk '{print $1}') -eq 0 ]; then
crit "AppArmor profiles not enable in the system "
FNRET=3
else
@ -41,12 +43,10 @@ audit () {
FNRET=0
fi
else
crit "There are not apparmor=1 and security=apparmor to GRUB_CMDLINE_LINUX in /etc/default/grub"
crit "There are ${SETSTRING} to ${KEYWORD} in ${GRUBFILE}"
FNRET=2
fi
fi
}
# This function will be called if the script status is on enabled mode
@ -60,13 +60,13 @@ apply () {
apt_install $PACKAGE
done
elif [ $FNRET = 2 ]; then
warn "Set apparmor=1 and security=apparmor to GRUB_CMDLINE_LINUX in /etc/default/grub"
replace_in_file ${GRUBFILE} "^GRUB_CMDLINE_LINUX=.*" "" "${GRUBPATTERN}"
warn "Set ${SETSTRING} to ${GRUBFILE} in ${GRUBFILE}, need reboot the system and enable AppArmor profiles after set it."
sed -ie "s;\(${KEYWORD}=\)\(\".*\)\(\"\);\1\2 ${SETSTRING}\3;" ${GRUBFILE}
/usr/sbin/update-grub2
elif [ $FNRET = 3 ]; then
warn "Enable AppArmor profiles in the system "
aa-enforce /etc/apparmor.d/*
/usr/sbin/aa-enforce /etc/apparmor.d/*
fi
:
}
# This function will check config parameters required

1
lib/utils.sh
View File

@ -150,6 +150,7 @@ add_line_file_after_pattern() {
}
replace_in_file() {
set -x
local FILE=$1
local SOURCE=$2
local DESTINATION=$3