tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-28 08:14:10 +02:00
Code Issues Packages Projects Releases Wiki Activity

Test for LINUX_VERSION before setting it again

Browse Source 
Before parsing /etc/debian-release and /etc/lsb-release,
it is now checked if the variable LINUX_VERSION is already set.

This fixes cisofy/lynis#1003, but has some side effects.

This will affects Ubuntu and Debian based distributions, like:
 - Pop!_OS (Ubuntu based)
 - Kali (Debian Based)
 - Raspbian
 - ...

Unfortunately this will likely skip/brake a few tests for those
distributions, as they are not considered to be Ubuntu or Debian
anymore. Linux Mint was already detected properly, but at least some
tests already had support for them (will other tests for Ubuntu are
skipped).

Those are tests I identified that will be skipped incorrectly now:
 - BOOT-5180: Check for Linux boot services (Debian style)
     It was already skipped on Linux Mint.
 - KRNL-5622: Check default run level on Linux machines
     This will only be skipped if systemd is not installed. It is
     already skipped on Linux Mint in this case.
 - KRNL-5788: Checking availability new kernel (sic!)
     This was already skipped on Linux Mint.
 - PKGS-7388: Check security repository (...)
     It will now be skipped for all distributions that do use the
     Debian / Ubuntu security repositories but are not detected as such
     anymore (like Pop!_OS). It will now be correctly skipped on
     Raspbian. This test was already aware of Linux Mint.
 - PKGS-7390: Check Ubuntu database consitency
     I am not sure why this test is Ubuntu only, thus it already
     skipped on Debian and Mint.
 - PKGS-7394: Check Ubuntu upgradeable packages
     I am not sure why this is for Ubuntu only, too.
     I think this should be feature tested instead, as
     apt-show-versions can be installed on any Debian based
     distribution as well..
 - PKGS-7366: Checking if debsecan is installed (...)
     While it may be correct to skip, debsecan remains usefull if
     package versions, patches and vulnerability fixes are very close
     on Debian itself.
     It is the correct behaviour to not do this test on Ubuntu and
     Ubuntu based distributions, as Canonical does not provide the
     required databases.
 - PKGS-7420: (Autoupdates)
     Linux Mint was already skipped on this test.

I think this could be solved by introducing a variable like
LINUX_VERSION_PARENT. On Linux Mint it would be set to Ubuntu, on e.g.
Kali Linux the veriable has the value Debian. Tests can use this variable
to check if it is broadly applicable, and then check if the specific
distribution is excluded.
This commit is contained in:
Simon Biewald 2020-08-07 22:38:10 +01:00
parent 7df0b8618b
commit 529bcb2a60
No known key found for this signature in database
GPG Key ID: DAD5F452603F1344
1 changed files with 20 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/osdetection
View File

@ -308,15 +308,14 @@
# CPUBuilders Linux # CPUBuilders Linux
if [ -e "/etc/cpub-release" ]; then OS_FULLNAME=$(cat /etc/cpub-release); fi if [ -e "/etc/cpub-release" ]; then OS_FULLNAME=$(cat /etc/cpub-release); fi
if [ -z "${LINUX_VERSION}" ] && [ -e "/etc/debian_version" ]; then
# Debian/Ubuntu (***) - Set first to Debian # Debian/Ubuntu (***) - Set first to Debian
if [ -e "/etc/debian_version" ]; then
OS_VERSION=$(cat /etc/debian_version) OS_VERSION=$(cat /etc/debian_version)
OS_FULLNAME="Debian ${OS_VERSION}" OS_FULLNAME="Debian ${OS_VERSION}"
LINUX_VERSION="Debian" LINUX_VERSION="Debian"
fi
# /etc/lsb-release does not exist on Debian # /etc/lsb-release does not exist on Debian
if [ -e "/etc/debian_version" -a -e /etc/lsb-release ]; then if [ -e /etc/lsb-release ]; then
OS_VERSION=$(cat /etc/debian_version) OS_VERSION=$(cat /etc/debian_version)
FIND=$(grep "^DISTRIB_ID=" /etc/lsb-release | cut -d '=' -f2 | sed 's/"//g') FIND=$(grep "^DISTRIB_ID=" /etc/lsb-release | cut -d '=' -f2 | sed 's/"//g')
if [ "${FIND}" = "Ubuntu" ]; then if [ "${FIND}" = "Ubuntu" ]; then
@ -334,6 +333,7 @@
fi fi
# Ubuntu test (optional) $(grep "[Uu]buntu" /proc/version) # Ubuntu test (optional) $(grep "[Uu]buntu" /proc/version)
fi fi
fi
# Override for Linux Mint, as that is initially detected as Debian or Ubuntu # Override for Linux Mint, as that is initially detected as Debian or Ubuntu
if [ -x /usr/bin/lsb_release ]; then if [ -x /usr/bin/lsb_release ]; then