diff --git a/bin/hardening/2.1_tmp_partition.sh b/bin/hardening/2.1_tmp_partition.sh index 6f38206..499d273 100755 --- a/bin/hardening/2.1_tmp_partition.sh +++ b/bin/hardening/2.1_tmp_partition.sh @@ -80,7 +80,7 @@ apply () { $SUDO_CMD systemctl daemon-reload $SUDO_CMD systemctl start "$SERVICENAME" else - crit "System unit file $REDHAT_SERVICEPATH is not exist!" + crit "System unit file $REDHAT_SERVICEPATH is not exist!" fi fi fi diff --git a/bin/hardening/2.3_tmp_nosuid.sh b/bin/hardening/2.3_tmp_nosuid.sh index e41e267..4c88b99 100755 --- a/bin/hardening/2.3_tmp_nosuid.sh +++ b/bin/hardening/2.3_tmp_nosuid.sh @@ -17,9 +17,10 @@ HARDENING_LEVEL=2 # Quick factoring as many script use the same logic PARTITION="/tmp" OPTION="nosuid" -SERVICEPATH="/usr/share/systemd/tmp.mount" +SERVICEPATH_DEBIAN="/usr/share/systemd/tmp.mount" SERVICENAME="tmp.mount" REDHAT_SERVICEPATH="/usr/lib/systemd/system/tmp.mount" +DEBIAN_SERVICEPATH="/lib/systemd/system/tmp.mount" # This function will be called if the script status is on enabled / audit mode audit () { @@ -45,36 +46,51 @@ audit () { FNRET=1 fi else - warn "$PARTITION is not partition in /etc/fstab, check tmp.mount service" - if [ -e $SERVICEPATH -o -e $REDHAT_SERVICEPATH ]; then - if [ $OS_RELEASE -eq 2 ]; then - has_mount_option_systemd $REDHAT_SERVICEPATH $OPTION + warn "$PARTITION is not partition in /etc/fstab, check tmp.mount service" + if [ $OS_RELEASE -eq 1 ]; then + if [ -e $DEBIAN_SERVICEPATH ]; then + has_mount_option_systemd $DEBIAN_SERVICEPATH $OPTION + if [ $FNRET -gt 0 ]; then + crit "$PARTITION has no option $OPTION in systemd service!" + FNRET=3 + else + ok "$PARTITION has $OPTION in systemd service" + has_mounted_option $PARTITION $OPTION + if [ $FNRET -gt 0 ]; then + warn "$PARTITION is not mounted with $OPTION at runtime" + FNRET=5 + else + ok "$PARTITION mounted with $OPTION" + FNRET=0 + fi + fi else - has_mount_option_systemd $SERVICEPATH $OPTION + crit "$DEBIAN_SERVICEPATH is not exist! Please apply 2.1 first!" + FNRET=2 fi - if [ $FNRET -gt 0 ]; then - crit "$PARTITION has no option $OPTION in systemd service!" - FNRET=3 - else - ok "$PARTITION has $OPTION in systemd service" - has_mounted_option $PARTITION $OPTION - if [ $FNRET -gt 0 ]; then - warn "$PARTITION is not mounted with $OPTION at runtime" - FNRET=5 - else - ok "$PARTITION mounted with $OPTION" - FNRET=0 - fi - fi - else - if [ $OS_RELEASE -eq 2 ]; then - crit "$REDHAT_SERVICEPATH is not exist!" + elif [ $OS_RELEASE -eq 2 ]; then + if [ -e $REDHAT_SERVICEPATH ]; then + has_mount_option_systemd $REDHAT_SERVICEPATH $OPTION + if [ $FNRET -gt 0 ]; then + crit "$PARTITION has no option $OPTION in systemd service!" + FNRET=3 + else + ok "$PARTITION has $OPTION in systemd service" + has_mounted_option $PARTITION $OPTION + if [ $FNRET -gt 0 ]; then + warn "$PARTITION is not mounted with $OPTION at runtime" + FNRET=5 + else + ok "$PARTITION mounted with $OPTION" + FNRET=0 + fi + fi else - crit "$SERVICEPATH is not exist!" - fi - FNRET=2 - fi - fi + crit "$REDHAT_SERVICEPATH is not exist! Please apply 2.1 first!" + FNRET=2 + fi + fi + fi } # This function will be called if the script status is on enabled mode @@ -82,7 +98,7 @@ apply () { if [ $FNRET = 0 ]; then ok "$PARTITION is correctly set" elif [ $FNRET = 2 ]; then - crit "$PARTITION is not a partition, correct this by yourself, I cannot help you here" + crit "System unit $SERVICENAME is not exist! Please apply 2.1 first!" elif [ $FNRET = 1 ]; then info "Adding $OPTION to fstab" add_option_to_fstab $PARTITION $OPTION @@ -98,7 +114,7 @@ apply () { if [ $OS_RELEASE -eq 2 ]; then add_option_to_systemd $REDHAT_SERVICEPATH $OPTION $SERVICENAME else - add_option_to_systemd $SERVICEPATH $OPTION $SERVICENAME + add_option_to_systemd $DEBIAN_SERVICEPATH $OPTION $SERVICENAME fi remount_partition_by_systemd $SERVICENAME $PARTITION elif [ $FNRET = 4 ]; then