tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix issues #15 auditd check has duplicates.

This commit is contained in:
Samson-W 2020-05-17 03:31:07 +08:00
parent 654813d8b4
commit 33c9611cc5
3 changed files with 26 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bin/hardening/8.1.31_record_syscall_execve.sh → bin/hardening/8.1.12_record_syscall_execve.sh
View File

@ -5,7 +5,7 @@
# #
# #
# 8.1.31 Collect the execution of privileged functions Events (Scored) # 8.1.12 Collect the execution of privileged functions Events (Scored)
# Author: Samson-W (sccxboy@gmail.com) # Author: Samson-W (sccxboy@gmail.com)
# #

12
bin/hardening/8.1.12_record_privileged_commands.sh → bin/hardening/8.1.31_record_privileged_commands.sh
View File

@ -5,7 +5,7 @@
# #
# #
# 8.1.12 Collect Use of Privileged Commands (Scored) # 8.1.31 Collect Use of Privileged Commands (Scored)
# #
set -e # One error, it's over set -e # One error, it's over
@ -28,12 +28,13 @@ audit () {
for AUDIT_VALUE in $AUDIT_PARAMS; do for AUDIT_VALUE in $AUDIT_PARAMS; do
debug "$AUDIT_VALUE should be in file $FILE" debug "$AUDIT_VALUE should be in file $FILE"
IFS=$d_IFS IFS=$d_IFS
does_pattern_exist_in_file $FILE "$AUDIT_VALUE" RESULT=$(echo $AUDITRULE | awk -F"-F" '{print $2}' | awk -F"=" '{print $2}')
does_valid_pattern_exist_in_file $FILE "$RESULT"
IFS=$c_IFS IFS=$c_IFS
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
crit "$AUDIT_VALUE is not in file $FILE" crit "$RESULT is not in file $FILE"
else else
ok "$AUDIT_VALUE is present in $FILE" ok "$RESULT is present in $FILE"
fi fi
done done
IFS=$d_IFS IFS=$d_IFS
@ -44,7 +45,8 @@ apply () {
IFS=$'\n' IFS=$'\n'
for AUDIT_VALUE in $AUDIT_PARAMS; do for AUDIT_VALUE in $AUDIT_PARAMS; do
debug "$AUDIT_VALUE should be in file $FILE" debug "$AUDIT_VALUE should be in file $FILE"
does_pattern_exist_in_file $FILE "$AUDIT_VALUE" RESULT=$(echo $AUDITRULE | awk -F"-F" '{print $2}' | awk -F"=" '{print $2}')
does_valid_pattern_exist_in_file $FILE "$RESULT"
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
warn "$AUDIT_VALUE is not in file $FILE, adding it" warn "$AUDIT_VALUE is not in file $FILE, adding it"
add_end_of_file $FILE $AUDIT_VALUE add_end_of_file $FILE $AUDIT_VALUE

18
lib/utils.sh
View File

@ -211,7 +211,25 @@ does_pattern_exist_in_file() {
debug "File $FILE is not readable!" debug "File $FILE is not readable!"
FNRET=2 FNRET=2
fi fi
}
# Check after deleting blank lines and comment lines
does_valid_pattern_exist_in_file() {
local FILE=$1
local PATTERN=$2
debug "Checking if $PATTERN is present in $FILE"
if $SUDO_CMD [ -r "$FILE" ] ; then
debug "$SUDO_CMD sed '/^#/d' $FILE | sed '/^$/d' | grep -c '$PATTERN'"
if [ $($SUDO_CMD sed '/^#/d' $FILE | sed '/^$/d' | grep -c "$PATTERN") -gt 0 ]; then
FNRET=0
else
FNRET=1
fi
else
debug "File $FILE is not readable!"
FNRET=2
fi
} }
add_end_of_file() { add_end_of_file() {