tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-31 01:24:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix some bugs for mount option of tmp partition

Browse Source
This commit is contained in:
samson 2018-12-06 13:44:55 +08:00
parent e720cc891e
commit 5c52acf20a
2 changed files with 23 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
bin/hardening/2.1_tmp_partition.sh
View File

@ -2,6 +2,7 @@
# #
# harbian audit Debian 7/8/9 Hardening # harbian audit Debian 7/8/9 Hardening
# Modify by: Samson-W (sccxboy@gmail.com)
# #
# #
@ -11,7 +12,7 @@
set -e # One error, it's over set -e # One error, it's over
set -u # One variable unset, it's over set -u # One variable unset, it's over
HARDENING_LEVEL=3 HARDENING_LEVEL=2
# Quick factoring as many script use the same logic # Quick factoring as many script use the same logic
PARTITION="/tmp" PARTITION="/tmp"

68
bin/hardening/2.2_tmp_nodev.sh
View File

@ -2,6 +2,7 @@
# #
# harbian audit Debian 7/8/9 Hardening # harbian audit Debian 7/8/9 Hardening
# Modify by: Samson-W (sccxboy@gmail.com)
# #
# #
@ -21,55 +22,37 @@ SERVICENAME="tmp.mount"
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
info "Verifying that $PARTITION is a partition/filesystem" info "Verifying that $PARTITION is a partition/filesystem"
FNRET=0 FNRET=0
is_debian_9 #If /tmp is set in /etc/fstab, only check /etc/fstab and disable tmp.mount service if it's exist
if [ $FNRET -gt 0 ]; then is_a_partition "$PARTITION"
is_a_partition "$PARTITION" if [ $FNRET -eq 0 ]; then
if [ $FNRET -gt 0 ]; then ok "$PARTITION is a partition"
crit "$PARTITION is not a partition" has_mount_option $PARTITION $OPTION
FNRET=2 if [ $FNRET -eq 0 ]; then
else ok "$PARTITION has $OPTION in fstab"
ok "$PARTITION is a partition" FNRET=0
has_mount_option $PARTITION $OPTION else
if [ $FNRET -gt 0 ]; then crit "$PARTITION has no option $OPTION in fstab!"
crit "$PARTITION has no option $OPTION in fstab!" FNRET=1
FNRET=1 fi
else
ok "$PARTITION has $OPTION in fstab"
has_mounted_option $PARTITION $OPTION
if [ $FNRET -gt 0 ]; then
warn "$PARTITION is not mounted with $OPTION at runtime"
FNRET=3
else
ok "$PARTITION mounted with $OPTION"
fi
fi
fi
else else
is_mounted "$PARTITION" warn "$PARTITION is not partition in /etc/fstab, check tmp.mount service"
if [ $FNRET -gt 0 ]; then if [ -e $SERVICEPATH ]; then
crit "$PARTITION is not mounted"
FNRET=4
else
has_mount_option_systemd $SERVICEPATH $OPTION has_mount_option_systemd $SERVICEPATH $OPTION
if [ $FNRET -gt 0 ]; then if [ $FNRET -gt 0 ]; then
crit "$PARTITION has no option $OPTION in systemd service!" crit "$PARTITION has no option $OPTION in systemd service!"
FNRET=5 FNRET=3
else else
ok "$PARTITION has $OPTION in systemd service" ok "$PARTITION has $OPTION in systemd service"
has_mounted_option $PARTITION $OPTION FNRET=0
if [ $FNRET -gt 0 ]; then
warn "$PARTITION is not mounted with $OPTION at runtime"
FNRET=6
else
ok "$PARTITION mounted with $OPTION"
fi
fi fi
else
crit "$TMPMOUNTO is not exist!"
FNRET=2
fi fi
fi fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
@ -84,18 +67,9 @@ apply () {
info "Remounting $PARTITION from fstab" info "Remounting $PARTITION from fstab"
remount_partition $PARTITION remount_partition $PARTITION
elif [ $FNRET = 3 ]; then elif [ $FNRET = 3 ]; then
info "Remounting $PARTITION from fstab"
remount_partition $PARTITION
elif [ $FNRET = 4 ]; then
info "Remounting $PARTITION from systemd"
remount_partition_by_systemd $SERVICENAME $PARTITION
elif [ $FNRET = 5 ]; then
info "Remounting $PARTITION from systemd" info "Remounting $PARTITION from systemd"
add_option_to_systemd $SERVICEPATH $OPTION $SERVICENAME add_option_to_systemd $SERVICEPATH $OPTION $SERVICENAME
remount_partition_by_systemd $SERVICENAME $PARTITION remount_partition_by_systemd $SERVICENAME $PARTITION
elif [ $FNRET = 6 ]; then
info "Remounting $PARTITION from systemd"
remount_partition_by_systemd $SERVICENAME $PARTITION
fi fi
} }