tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-30 17:15:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add a function to detect MAC that has been activated.

Browse Source
This commit is contained in:
Samson-W 2020-06-04 02:52:06 +08:00
parent 2d1e57dca9
commit fc24c6bc35
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
bin/hardening/4.5_enable_apparmor.sh
View File

@ -20,8 +20,13 @@ PATTERN="apparmor=1[[:space:]]*security=apparmor"
SETSTRING="apparmor=1 security=apparmor" SETSTRING="apparmor=1 security=apparmor"
GRUBFILE='/etc/default/grub' GRUBFILE='/etc/default/grub'
SERVICENAME='apparmor.service' SERVICENAME='apparmor.service'
SELINUXSETSTRING="security=selinux"
audit_debian () { audit_debian () {
if [ $(grep -c "${SELINUXSETSTRING}" /proc/cmdline) -eq 1 ]; then
ok "SELinux was actived. So pass."
return 0
fi
for PACKAGE in ${PACKAGES} for PACKAGE in ${PACKAGES}
do do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
@ -79,6 +84,10 @@ audit () {
} }
apply_debian () { apply_debian () {
if [ $(grep -c "${SELINUXSETSTRING}" /proc/cmdline) -eq 1 ]; then
ok "SELinux was actived. So pass."
return 0
fi
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "AppArmor profiles is enable in the system " ok "AppArmor profiles is enable in the system "
elif [ $FNRET = 1 ]; then elif [ $FNRET = 1 ]; then

11
bin/hardening/4.6_enable_selinux.sh
View File

@ -16,8 +16,13 @@ HARDENING_LEVEL=3
PACKAGES='selinux-basics selinux-policy-default' PACKAGES='selinux-basics selinux-policy-default'
SETSTRING="security=selinux" SETSTRING="security=selinux"
APPARMOR_RUN="/sys/kernel/security/apparmor/"
audit_debian () { audit_debian () {
if [ -d APPARMOR_RUN ]; then
ok "AppArmor was actived. So pass."
return 0
fi
# Only support for Debian 10 (Buster) # Only support for Debian 10 (Buster)
is_debian_ge_10 is_debian_ge_10
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -80,6 +85,10 @@ audit () {
} }
apply_debian () { apply_debian () {
if [ -d $APPARMOR_RUN ]; then
ok "AppArmor was actived. So pass."
return 0
fi
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "SELinux is active and in Enforcing mode." ok "SELinux is active and in Enforcing mode."
elif [ $FNRET = 1 ]; then elif [ $FNRET = 1 ]; then
@ -92,7 +101,7 @@ apply_debian () {
warn "Set SELinux to activate." warn "Set SELinux to activate."
selinux-activate selinux-activate
elif [ $FNRET = 3 ]; then elif [ $FNRET = 3 ]; then
warn "Set SELinux to enforcing mode." warn "Set SELinux to enforcing mode, and need reboot"
replace_in_file '/etc/selinux/config' 'SELINUX=.*' 'SELINUX=enforcing' replace_in_file '/etc/selinux/config' 'SELINUX=.*' 'SELINUX=enforcing'
else else
warn "SELinux check only support Debian 10." warn "SELinux check only support Debian 10."