From a7ae943c5270aad47dbf6b08335025a93b7789a8 Mon Sep 17 00:00:00 2001
From: Samson-W <samson@hardenedlinux.org>
Date: Thu, 4 Jun 2020 21:00:35 +0800
Subject: [PATCH] Rename 4.7 to 4.8, and add audit and apply methods for
 4.7_enable_selinux_policy.sh

---
 bin/hardening/4.7_enable_selinux_policy.sh    | 121 ++++++++++++++++++
 ..._devices.sh => 4.8_disable_usb_devices.sh} |   2 +-
 2 files changed, 122 insertions(+), 1 deletion(-)
 create mode 100755 bin/hardening/4.7_enable_selinux_policy.sh
 rename bin/hardening/{4.7_disable_usb_devices.sh => 4.8_disable_usb_devices.sh} (99%)

diff --git a/bin/hardening/4.7_enable_selinux_policy.sh b/bin/hardening/4.7_enable_selinux_policy.sh
new file mode 100755
index 0000000..7412cb2
--- /dev/null
+++ b/bin/hardening/4.7_enable_selinux_policy.sh
@@ -0,0 +1,121 @@
+#!/bin/bash
+
+#
+# harbian-audit for Debian GNU/Linux 9/10 or CentOS 8 Hardening
+#
+
+#
+# 4.7 Enable SELinux targeted policy (Scored)
+# Add by Author : Samson-W (samson@hardenedlinux.org)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+HARDENING_LEVEL=3
+
+APPARMOR_RUN="/sys/kernel/security/apparmor/"
+SELINUXCONF_FILE='/etc/selinux/config'
+SELINUXTYPE_VALUE='SELINUXTYPE=default'
+
+audit_debian () {
+	if [ -d $APPARMOR_RUN ]; then
+		ok "AppArmor was actived. So pass."
+		return 0
+	fi
+	does_valid_pattern_exist_in_file $SELINUXCONF_FILE $SELINUXTYPE_VALUE
+	if [ ${FNRET} -eq 0 ]; then
+		ok "SELinux targeted policy was enabled."			
+		FNRET=0
+	else	
+		crit "SELinux targeted policy is not enable."			
+		FNRET=1
+	fi
+}
+
+audit_centos () {
+	does_valid_pattern_exist_in_file $SELINUXCONF_FILE $SELINUXTYPE_VALUE
+	if [ ${FNRET} -eq 0 ]; then
+		ok "SELinux targeted policy was enabled."			
+		FNRET=0
+	else	
+		crit "SELinux targeted policy is not enable."			
+		FNRET=1
+	fi
+}
+
+# This function will be called if the script status is on enabled / audit mode
+audit () {
+	if [ $OS_RELEASE -eq 1 ]; then
+        audit_debian
+    elif [ $OS_RELEASE -eq 2 ]; then
+        audit_centos
+    else
+        crit "Current OS is not support!"
+        FNRET=44
+    fi
+}
+
+apply_debian () {
+	if [ -d $APPARMOR_RUN ]; then
+		ok "AppArmor was actived. So pass."
+		return 0
+	fi
+    if [ $FNRET = 0 ]; then
+		ok "SELinux targeted policy was enabled."			
+    elif [ $FNRET = 1 ]; then
+		warn "Set SELinux targeted policy to enable, and need root"			
+		replace_in_file $SELINUXCONF_FILE 'SELINUXTYPE=.*' $SELINUXTYPE_VALUE
+	else
+		:
+    fi
+}
+
+apply_centos () {
+    if [ $FNRET = 0 ]; then
+		ok "SELinux targeted policy was enabled."			
+    elif [ $FNRET = 1 ]; then
+		warn "Set SELinux targeted policy to enable, and need root"			
+		replace_in_file $SELINUXCONF_FILE 'SELINUXTYPE=.*' $SELINUXTYPE_VALUE
+	else
+		:
+	fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply () {
+	if [ $OS_RELEASE -eq 1 ]; then
+        apply_debian
+    elif [ $OS_RELEASE -eq 2 ]; then
+        apply_centos
+    else
+        crit "Current OS is not support!"
+    fi
+}
+
+# This function will check config parameters required
+check_config() {
+	if [ $OS_RELEASE -eq 2 ]; then
+		SELINUXTYPE_VALUE='SELINUXTYPE=targeted'
+	else
+		:
+	fi
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_ROOT_DIR" ]; then
+     echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+     echo "Cannot source CIS_ROOT_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then
+    . $CIS_ROOT_DIR/lib/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening"
+    exit 128
+fi
diff --git a/bin/hardening/4.7_disable_usb_devices.sh b/bin/hardening/4.8_disable_usb_devices.sh
similarity index 99%
rename from bin/hardening/4.7_disable_usb_devices.sh
rename to bin/hardening/4.8_disable_usb_devices.sh
index dd60965..5a8af62 100755
--- a/bin/hardening/4.7_disable_usb_devices.sh
+++ b/bin/hardening/4.8_disable_usb_devices.sh
@@ -6,7 +6,7 @@
 #
 
 #
-# 4.6 Disable USB Devices
+# 4.8 Disable USB Devices
 # TODO test
 #