tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-29 16:54:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Initial support for DNF package manager

Browse Source
This commit is contained in:
mboelen 2016-01-25 13:18:59 +01:00
parent 00ebad930a
commit 1e12852b12
2 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/binaries
View File

@ -96,6 +96,7 @@
debsecan) DEBSECANBINARY="${BINARY}"; logtext " Found known binary: debsecan (package vulnerability checking) - ${BINARY}" ;;
debsums) DEBSUMSBINARY="${BINARY}"; logtext " Found known binary: debsums (package integrity checking) - ${BINARY}" ;;
dig) if [ -f ${BINARY} ]; then DIGFOUND=1; DIGBINARY=${BINARY}; logtext " Found known binary: dig (network/dns tool) - ${BINARY}"; fi ;;
dnf) DNFBINARY="${BINARY}"; logtext " Found known binary: dnf (package manager) - ${BINARY}"; ;;
dnsdomainname) DNSDOMAINNAMEFOUND=1; DNSDOMAINNAMEBINARY="${BINARY}"; logtext " Found known binary: dnsdomainname (DNS domain) - ${BINARY}" ;;
docker) if [ -f ${BINARY} ]; then DOCKERBINARY="${BINARY}"; logtext " Found known binary: docker (container technology) - ${BINARY}"; fi ;;
domainname) DOMAINNAMEFOUND=1; DOMAINNAMEBINARY="${BINARY}"; logtext " Found known binary: domainname (NIS domain) - ${BINARY}" ;;

38
include/tests_ports_packages
View File

@ -374,6 +374,44 @@
fi
#
#################################################################################
#
# Test : PKGS-7350
# Description : Use Dandified YUM
# Notes : Possible replacement for YUM in the long term
if [ ! "${DNFBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no "PKGS-7350" --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking for DNF utility and its output"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Result: found DNF (Dandified YUM) utility"
PACKAGE_AUDIT_TOOL_FOUND=1
PACKAGE_AUDIT_TOOL="dnf"
SPACKAGES=`${DNFBINARY} -q list installed 2>&1 /dev/null | awk '{ if ($1!="Installed" && $1!="Last") {print $1","$2 }}'`
for J in ${SPACKAGES}; do
N=`expr ${N} + 1`
PACKAGE_NAME=`echo ${J} | cut -d ',' -f2`
PACKAGE_VERSION=`echo ${J} | cut -d ',' -f3`
LogText "Found package: ${PACKAGE_NAME} (version: ${PACKAGE_VERSION})"
INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${PACKAGE_NAME},${PACKAGE_VERSION}"
done
Report "installed_packages=${N}"
# Check for security updates
LogText "Action: checking updateinfo for security updates"
FIND=`${DNFBINARY} -q updateinfo list sec | awk '{ if ($2=="security") {print $3}}'`
if [ ! "${FIND}" = "" ]; then
VULNERABLE_PACKAGES_FOUND=1
for PKG in ${FIND}; do
Report "vulnerable_package[]=${I}"
LogText "Vulnerable package: ${I}"
# Decrease hardening points for every found vulnerable package
AddHP 1 2
done
else
LogText "Result: no security updates found"
AddHP 5 5
fi
fi
#
#################################################################################
#
# Test : PKGS-7366
# Description : Checking if debsecan is installed and enabled on Debian systems