tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Modify audit method of 2.2, and add has_mount_option_systemd method.

This commit is contained in:
Samson-W 2018-08-24 03:25:46 +08:00
parent 9f7c4d56f8
commit 214c11a0cd
2 changed files with 66 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
bin/hardening/2.2_tmp_nodev.sh
View File

@ -1,11 +1,11 @@
#!/bin/bash #!/bin/bash
# #
# CIS Debian 7/8 Hardening # harbian audit Debian 7/8/9 Hardening
# #
# #
# 2.2 Set nodev option for /tmp Partition (Scored) # 2.2 Set nodev option for /tmp Partition/filesystem (Scored)
# #
set -e # One error, it's over set -e # One error, it's over
@ -16,11 +16,14 @@ HARDENING_LEVEL=2
# Quick factoring as many script use the same logic # Quick factoring as many script use the same logic
PARTITION="/tmp" PARTITION="/tmp"
OPTION="nodev" OPTION="nodev"
SERVICENAME="/etc/systemd/system/tmp.mount"
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
info "Verifying that $PARTITION is a partition" info "Verifying that $PARTITION is a partition/filesystem"
FNRET=0 FNRET=0
is_debian_9
if [ $FNRET -gt 0 ]; then
is_a_partition "$PARTITION" is_a_partition "$PARTITION"
if [ $FNRET -gt 0 ]; then if [ $FNRET -gt 0 ]; then
crit "$PARTITION is not a partition" crit "$PARTITION is not a partition"
@ -42,6 +45,30 @@ audit () {
fi fi
fi fi
fi fi
else
is_mounted "$PARTITION"
if [ $FNRET -gt 0 ]; then
crit "$PARTITION is not mounted"
FNRET=4
else
has_mount_option_systemd $SERVICENAME $OPTION
if [ $FNRET -gt 0 ]; then
crit "$PARTITION has no option $OPTION in systemd service!"
FNRET=5
else
ok "$PARTITION has $OPTION in systemd service"
has_mounted_option $PARTITION $OPTION
if [ $FNRET -gt 0 ]; then
warn "$PARTITION is not mounted with $OPTION at runtime"
FNRET=6
else
ok "$PARTITION mounted with $OPTION"
fi
fi
fi
fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
@ -58,6 +85,15 @@ apply () {
elif [ $FNRET = 3 ]; then elif [ $FNRET = 3 ]; then
info "Remounting $PARTITION from fstab" info "Remounting $PARTITION from fstab"
remount_partition $PARTITION remount_partition $PARTITION
elif [ $FNRET = 4 ]; then
info "Remounting $PARTITION from systemd"
remount_partition $PARTITION
elif [ $FNRET = 5 ]; then
info "Remounting $PARTITION from systemd"
remount_partition $PARTITION
elif [ $FNRET = 6 ]; then
info "Remounting $PARTITION from systemd"
remount_partition $PARTITION
fi fi
} }

13
lib/utils.sh
View File

@ -289,6 +289,19 @@ has_mount_option() {
fi fi
} }
# Verify option $2 in $1 service
has_mount_option_systemd() {
local SERVICENAME=$1
local OPTION=$2
if $(grep -i "options" "$SERVICENAME" | grep -vE "^#" | grep -q "$2"); then
debug "$OPTION has been detected in systemd service $SERVICENAME"
FNRET=0
else
debug "Unable to find $OPTION in systemd service $SERVICENAME"
FNRET=1
fi
}
# Verify $1 has the proper option $2 at runtime # Verify $1 has the proper option $2 at runtime
has_mounted_option() { has_mounted_option() {
local PARTITION=$1 local PARTITION=$1