tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix some bugs for 2.1 2.3

This commit is contained in:
Samson-W 2019-09-06 04:55:26 +08:00
parent 10fb74a744
commit 74c2984631
2 changed files with 47 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bin/hardening/2.1_tmp_partition.sh
View File

@ -80,7 +80,7 @@ apply () {
$SUDO_CMD systemctl daemon-reload
$SUDO_CMD systemctl start "$SERVICENAME"
else
crit "System unit file $REDHAT_SERVICEPATH is not exist!"
crit "System unit file $REDHAT_SERVICEPATH is not exist!"
fi
fi
fi

76
bin/hardening/2.3_tmp_nosuid.sh
View File

@ -17,9 +17,10 @@ HARDENING_LEVEL=2
# Quick factoring as many script use the same logic
PARTITION="/tmp"
OPTION="nosuid"
SERVICEPATH="/usr/share/systemd/tmp.mount"
SERVICEPATH_DEBIAN="/usr/share/systemd/tmp.mount"
SERVICENAME="tmp.mount"
REDHAT_SERVICEPATH="/usr/lib/systemd/system/tmp.mount"
DEBIAN_SERVICEPATH="/lib/systemd/system/tmp.mount"
# This function will be called if the script status is on enabled / audit mode
audit () {
@ -45,36 +46,51 @@ audit () {
FNRET=1
fi
else
warn "$PARTITION is not partition in /etc/fstab, check tmp.mount service"
if [ -e $SERVICEPATH -o -e $REDHAT_SERVICEPATH ]; then
if [ $OS_RELEASE -eq 2 ]; then
has_mount_option_systemd $REDHAT_SERVICEPATH $OPTION
warn "$PARTITION is not partition in /etc/fstab, check tmp.mount service"
if [ $OS_RELEASE -eq 1 ]; then
if [ -e $DEBIAN_SERVICEPATH ]; then
has_mount_option_systemd $DEBIAN_SERVICEPATH $OPTION
if [ $FNRET -gt 0 ]; then
crit "$PARTITION has no option $OPTION in systemd service!"
FNRET=3
else
ok "$PARTITION has $OPTION in systemd service"
has_mounted_option $PARTITION $OPTION
if [ $FNRET -gt 0 ]; then
warn "$PARTITION is not mounted with $OPTION at runtime"
FNRET=5
else
ok "$PARTITION mounted with $OPTION"
FNRET=0
fi
fi
else
has_mount_option_systemd $SERVICEPATH $OPTION
crit "$DEBIAN_SERVICEPATH is not exist! Please apply 2.1 first!"
FNRET=2
fi
if [ $FNRET -gt 0 ]; then
crit "$PARTITION has no option $OPTION in systemd service!"
FNRET=3
else
ok "$PARTITION has $OPTION in systemd service"
has_mounted_option $PARTITION $OPTION
if [ $FNRET -gt 0 ]; then
warn "$PARTITION is not mounted with $OPTION at runtime"
FNRET=5
else
ok "$PARTITION mounted with $OPTION"
FNRET=0
fi
fi
else
if [ $OS_RELEASE -eq 2 ]; then
crit "$REDHAT_SERVICEPATH is not exist!"
elif [ $OS_RELEASE -eq 2 ]; then
if [ -e $REDHAT_SERVICEPATH ]; then
has_mount_option_systemd $REDHAT_SERVICEPATH $OPTION
if [ $FNRET -gt 0 ]; then
crit "$PARTITION has no option $OPTION in systemd service!"
FNRET=3
else
ok "$PARTITION has $OPTION in systemd service"
has_mounted_option $PARTITION $OPTION
if [ $FNRET -gt 0 ]; then
warn "$PARTITION is not mounted with $OPTION at runtime"
FNRET=5
else
ok "$PARTITION mounted with $OPTION"
FNRET=0
fi
fi
else
crit "$SERVICEPATH is not exist!"
fi
FNRET=2
fi
fi
crit "$REDHAT_SERVICEPATH is not exist! Please apply 2.1 first!"
FNRET=2
fi
fi
fi
}
# This function will be called if the script status is on enabled mode
@ -82,7 +98,7 @@ apply () {
if [ $FNRET = 0 ]; then
ok "$PARTITION is correctly set"
elif [ $FNRET = 2 ]; then
crit "$PARTITION is not a partition, correct this by yourself, I cannot help you here"
crit "System unit $SERVICENAME is not exist! Please apply 2.1 first!"
elif [ $FNRET = 1 ]; then
info "Adding $OPTION to fstab"
add_option_to_fstab $PARTITION $OPTION
@ -98,7 +114,7 @@ apply () {
if [ $OS_RELEASE -eq 2 ]; then
add_option_to_systemd $REDHAT_SERVICEPATH $OPTION $SERVICENAME
else
add_option_to_systemd $SERVICEPATH $OPTION $SERVICENAME
add_option_to_systemd $DEBIAN_SERVICEPATH $OPTION $SERVICENAME
fi
remount_partition_by_systemd $SERVICENAME $PARTITION
elif [ $FNRET = 4 ]; then