tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Modify 8.1.7 and 8.4.1 to be compatible with CentOS

This commit is contained in:
Samson-W 2019-08-14 18:40:30 +08:00
parent 7f23fe9c1c
commit fe19d99160
2 changed files with 29 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
bin/hardening/8.1.7_record_mac_edit.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9/10 or CentOS Hardening
# #
# #
@ -10,21 +10,26 @@
# #
# todo test for centos # todo test for centos
set -e # One error, it's over
set -u # One variable unset, it's over set -u # One variable unset, it's over
HARDENING_LEVEL=4 HARDENING_LEVEL=4
SELINUX_PKG="selinux-basics" SELINUX_PKG="selinux-basics"
SE_AUDIT_PARAMS='-w /etc/selinux/ -p wa -k MAC-policy SELINUX_PKG_REDHAT="selinux-policy"
-w /usr/share/selinux/ -p wa -k MAC-policy
-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=4294967295 -k perm_chng' SE_AUDIT_PARAMS="-a always,exit -F dir=/etc/selinux/ -F perm=wa -k MAC-policy
-a always,exit -F dir=/usr/share/selinux/ -F perm=wa -k MAC-policy
-a always,exit -F path=$(which chcon 2>/dev/null) -F perm=x -F auid>=1000 -F auid!=4294967295 -k perm_chng
-a always,exit -F path=$(which semanage 2>/dev/null) -F auid>=1000 -F auid!=4294967295 -k perm_chng
-a always,exit -F path=$(which setsebool 2>/dev/null) -F auid>=1000 -F auid!=4294967295 -k perm_chng
-a always,exit -F path=$(which setfiles 2>/dev/null) -F auid>=1000 -F auid!=4294967295 -k perm_chng"
APPARMOR_PKG="apparmor" APPARMOR_PKG="apparmor"
AA_AUDIT_PARAMS='-w /etc/apparmor/ -p wa -k MAC-policy AA_AUDIT_PARAMS='-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy -w /etc/apparmor.d/ -p wa -k MAC-policy
-a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F auid!=4294967295 -k MAC-policy' -a always,exit -F path=/sbin/apparmor_parser -F perm=x -F auid>=1000 -F auid!=4294967295 -k MAC-policy'
set -e # One error, it's over
FILE='/etc/audit/rules.d/audit.rules' FILE='/etc/audit/rules.d/audit.rules'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
@ -34,6 +39,9 @@ audit () {
# define custom IFS and save default one # define custom IFS and save default one
d_IFS=$IFS d_IFS=$IFS
IFS=$'\n' IFS=$'\n'
if [ $OS_RELEASE -eq 2 ]; then
SELINUX_PKG=$SELINUX_PKG_REDHAT
fi
is_pkg_installed $SELINUX_PKG is_pkg_installed $SELINUX_PKG
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
AUDIT_PARAMS=$SE_AUDIT_PARAMS AUDIT_PARAMS=$SE_AUDIT_PARAMS
@ -43,6 +51,8 @@ audit () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
AUDIT_PARAMS=$AA_AUDIT_PARAMS AUDIT_PARAMS=$AA_AUDIT_PARAMS
info "Apparmor has installed!" info "Apparmor has installed!"
else
crit "SELinux and Apparmor not install!"
fi fi
fi fi
for AUDIT_VALUE in $AUDIT_PARAMS; do for AUDIT_VALUE in $AUDIT_PARAMS; do
@ -61,6 +71,9 @@ audit () {
apply () { apply () {
d_IFS=$IFS d_IFS=$IFS
IFS=$'\n' IFS=$'\n'
if [ $OS_RELEASE -eq 2 ]; then
SELINUX_PKG=$SELINUX_PKG_REDHAT
fi
is_pkg_installed $SELINUX_PKG is_pkg_installed $SELINUX_PKG
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
AUDIT_PARAMS=$SE_AUDIT_PARAMS AUDIT_PARAMS=$SE_AUDIT_PARAMS
@ -70,6 +83,8 @@ apply () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
AUDIT_PARAMS=$AA_AUDIT_PARAMS AUDIT_PARAMS=$AA_AUDIT_PARAMS
info "Apparmor has installed!" info "Apparmor has installed!"
else
crit "SELinux and Apparmor not install!"
fi fi
fi fi
for AUDIT_VALUE in $AUDIT_PARAMS; do for AUDIT_VALUE in $AUDIT_PARAMS; do

13
bin/hardening/8.4.1_install_aide.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 9 Hardening # harbian audit 9/10 or CentOS Hardening
# #
# #
@ -34,9 +34,14 @@ apply () {
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
else else
crit "$PACKAGE is absent, installing it" crit "$PACKAGE is absent, installing it"
apt_install $PACKAGE if [ $OS_RELEASE -eq 2 ]; then
aideinit yum install -y $PACKAGE
info "${PACKAGE} is now installed but not fully functionnal, please see readme to go further" aide --init
else
apt_install $PACKAGE
aideinit
info "${PACKAGE} is now installed but not fully functionnal, please see readme to go further"
fi
fi fi
} }