tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-29 08:44:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

New function HasCorrectFilePermissions

Browse Source
This commit is contained in:
Michael Boelen 2019-08-17 16:48:46 +02:00
parent 8b9d853174
commit 0a3f42afbc
No known key found for this signature in database
GPG Key ID: 26141F77A09D7F04
1 changed files with 68 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
include/functions
View File

@ -193,6 +193,7 @@
CHECKFILE="$1" CHECKFILE="$1"
if [ ! -d ${CHECKFILE} -a ! -f ${CHECKFILE} ]; then if [ ! -d ${CHECKFILE} -a ! -f ${CHECKFILE} ]; then
PERMS="FILE_NOT_FOUND" PERMS="FILE_NOT_FOUND"
FILEVALUE=""
else else
# If 'file' is an directory, use -d # If 'file' is an directory, use -d
if [ -d ${CHECKFILE} ]; then if [ -d ${CHECKFILE} ]; then
@ -207,6 +208,73 @@
} }
################################################################################
# Name : HasCorrectFilePermissions()
# Description : Check file permissions
#
# Parameters : $1 = Full path to file or directory
# $2 = Permissions
# Returns : exit code (0 = correct, 1 = not correct)
################################################################################
HasCorrectFilePermissions() {
if [ $# -ne 2 ]; then Fatal "Incorrect usage of HasCorrectFilePermissions"; fi
CHECKFILE="$1"
CHECKPERMISSION_FULL="$2"
if [ ! -d ${CHECKFILE} -a ! -f ${CHECKFILE} ]; then
return 2
else
for CHECK_PERMISSION in ${CHECKPERMISSION_FULL}; do
DATA=$(echo ${CHECK_PERMISSION} | ${EGREPBINARY} "[rwx]")
if [ $? -eq 0 ]; then
# add first dummy character
CHECK_PERMISSION=$(echo "-${CHECK_PERMISSION}" | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
fi
LogText "Test: checking if file ${CHECKFILE} is ${CHECK_PERMISSION}"
if [ -n "${STATBINARY}" ]; then
DATA=$(${STATBINARY} --format=%a ${CHECKFILE})
LogText "Output: ${DATA}"
elif [ -n "${FINDBINARY}" ]; then
case ${OS} in
"AIX")
ReportException "HasCorrectFilePermissions:01" "OS not supported yet"
;;
*)
# Does not work for AIX
DATA=$(${FINDBINARY} ${CHECKFILE} -printf "%m")
;;
esac
else
# If 'file' is an directory, use -d
if [ -d ${CHECKFILE} ]; then
DATA=$(ls -d -l ${CHECKFILE} | cut -c 2-10)
else
DATA=$(ls -l ${CHECKFILE} | cut -c 2-10)
fi
# Convert permissions to octal
LogText "Converting ${DATA} to octal"
DATA=$(echo ${DATA} | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
LogText "Output: ${DATA}"
fi
if [ -n "${DATA}" ]; then
if [ "${DATA}" = "${CHECK_PERMISSION}" ]; then
LogText "Outcome: correct permissions"
return 0
fi
else
ReportException "HasCorrectFilePermissions:02" "No data value found, which is unexpected"
fi
done
LogText "Did not find the permissions of file ${CHECKFILE} matching any of the ${CHECKPERMISSION_FULL} values"
# No match, return exit code 1
return 1
fi
}
################################################################################ ################################################################################
# Name : CheckItem() # Name : CheckItem()
# Description : Check if a specific item exists in the report # Description : Check if a specific item exists in the report