tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-28 08:04:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add check_audit_is_immutable_mode method in lib/utils.sh and apply the method for 8.1.4

Browse Source
This commit is contained in:
Samson-W 2019-05-18 04:36:55 +08:00
parent 0bd15205e9
commit 8856f64d16
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bin/hardening/8.1.4_record_date_time_edit.sh
View File

@ -59,7 +59,7 @@ apply () {
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
warn "$AUDIT_VALUE is not in file $FILE, adding it" warn "$AUDIT_VALUE is not in file $FILE, adding it"
add_end_of_file $FILE $AUDIT_VALUE add_end_of_file $FILE $AUDIT_VALUE
eval $(pkill -HUP -P 1 auditd) check_audit_is_immutable_mode
else else
ok "$AUDIT_VALUE is present in $FILE" ok "$AUDIT_VALUE is present in $FILE"
fi fi

8
lib/utils.sh
View File

@ -872,3 +872,11 @@ check_ipv6_is_enable()
fi fi
} }
check_audit_is_immutable_mode()
{
if [ $(auditctl -s | head -n 1 | awk '{print $2}') -eq 2 ]; then
warn "The audit system is in immutable mode, no rule changes allowed. So must need reboot after adding/modifying the auditd rule!"
else
eval $(pkill -HUP -P 1 auditd)
fi
}