tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-27 07:34:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Modify audit and apply methods of 2.3, 2.4.

Browse Source
This commit is contained in:
Samson-W 2018-08-25 11:02:57 +08:00
parent b81b8d7e3a
commit 72d0274f73
2 changed files with 106 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
bin/hardening/2.3_tmp_nosuid.sh
View File

@ -5,7 +5,7 @@
# #
# #
# 2.3 Set nosuid option for /tmp Partition (Scored) # 2.3 Set nosuid option for /tmp filesystem/Partition (Scored)
# #
set -e # One error, it's over set -e # One error, it's over
@ -16,11 +16,15 @@ HARDENING_LEVEL=2
# Quick factoring as many script use the same logic # Quick factoring as many script use the same logic
PARTITION="/tmp" PARTITION="/tmp"
OPTION="nosuid" OPTION="nosuid"
SERVICEPATH="/etc/systemd/system/tmp.mount"
SERVICENAME="tmp.mount"
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
info "Verifying that $PARTITION is a partition" info "Verifying that $PARTITION is a filesystem/partition"
FNRET=0 FNRET=0
is_debian_9
if [ $FNRET -gt 0 ]; then
is_a_partition "$PARTITION" is_a_partition "$PARTITION"
if [ $FNRET -gt 0 ]; then if [ $FNRET -gt 0 ]; then
crit "$PARTITION is not a partition" crit "$PARTITION is not a partition"
@ -42,6 +46,29 @@ audit () {
fi fi
fi fi
fi fi
else
is_mounted "$PARTITION"
if [ $FNRET -gt 0 ]; then
crit "$PARTITION is not mounted"
FNRET=4
else
has_mount_option_systemd $SERVICEPATH $OPTION
if [ $FNRET -gt 0 ]; then
crit "$PARTITION has no option $OPTION in systemd service!"
FNRET=5
else
ok "$PARTITION has $OPTION in systemd service"
has_mounted_option $PARTITION $OPTION
if [ $FNRET -gt 0 ]; then
warn "$PARTITION is not mounted with $OPTION at runtime"
FNRET=6
else
ok "$PARTITION mounted with $OPTION"
fi
fi
fi
fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
@ -58,6 +85,16 @@ apply () {
elif [ $FNRET = 3 ]; then elif [ $FNRET = 3 ]; then
info "Remounting $PARTITION from fstab" info "Remounting $PARTITION from fstab"
remount_partition $PARTITION remount_partition $PARTITION
elif [ $FNRET = 4 ]; then
info "Remounting $PARTITION from systemd"
remount_partition_by_systemd $SERVICENAME $PARTITION
elif [ $FNRET = 5 ]; then
info "Remounting $PARTITION from systemd"
add_option_to_systemd $SERVICEPATH $OPTION $SERVICENAME
remount_partition_by_systemd $SERVICENAME $PARTITION
elif [ $FNRET = 6 ]; then
info "Remounting $PARTITION from systemd"
remount_partition_by_systemd $SERVICENAME $PARTITION
fi fi
} }

41
bin/hardening/2.4_tmp_noexec.sh
View File

@ -5,7 +5,7 @@
# #
# #
# 2.4 Set noexec option for /tmp Partition (Scored) # 2.4 Set noexec option for /tmp filesystem/Partition (Scored)
# #
set -e # One error, it's over set -e # One error, it's over
@ -16,11 +16,15 @@ HARDENING_LEVEL=3
# Quick factoring as many script use the same logic # Quick factoring as many script use the same logic
PARTITION="/tmp" PARTITION="/tmp"
OPTION="noexec" OPTION="noexec"
SERVICEPATH="/etc/systemd/system/tmp.mount"
SERVICENAME="tmp.mount"
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
info "Verifying that $PARTITION is a partition" info "Verifying that $PARTITION is a filesystem/partition"
FNRET=0 FNRET=0
is_debian_9
if [ $FNRET -gt 0 ]; then
is_a_partition "$PARTITION" is_a_partition "$PARTITION"
if [ $FNRET -gt 0 ]; then if [ $FNRET -gt 0 ]; then
crit "$PARTITION is not a partition" crit "$PARTITION is not a partition"
@ -42,6 +46,29 @@ audit () {
fi fi
fi fi
fi fi
else
is_mounted "$PARTITION"
if [ $FNRET -gt 0 ]; then
crit "$PARTITION is not mounted"
FNRET=4
else
has_mount_option_systemd $SERVICEPATH $OPTION
if [ $FNRET -gt 0 ]; then
crit "$PARTITION has no option $OPTION in systemd service!"
FNRET=5
else
ok "$PARTITION has $OPTION in systemd service"
has_mounted_option $PARTITION $OPTION
if [ $FNRET -gt 0 ]; then
warn "$PARTITION is not mounted with $OPTION at runtime"
FNRET=6
else
ok "$PARTITION mounted with $OPTION"
fi
fi
fi
fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
@ -58,6 +85,16 @@ apply () {
elif [ $FNRET = 3 ]; then elif [ $FNRET = 3 ]; then
info "Remounting $PARTITION from fstab" info "Remounting $PARTITION from fstab"
remount_partition $PARTITION remount_partition $PARTITION
elif [ $FNRET = 4 ]; then
info "Remounting $PARTITION from systemd"
remount_partition_by_systemd $SERVICENAME $PARTITION
elif [ $FNRET = 5 ]; then
info "Remounting $PARTITION from systemd"
add_option_to_systemd $SERVICEPATH $OPTION $SERVICENAME
remount_partition_by_systemd $SERVICENAME $PARTITION
elif [ $FNRET = 6 ]; then
info "Remounting $PARTITION from systemd"
remount_partition_by_systemd $SERVICENAME $PARTITION
fi fi
} }