tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-27 07:44:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

[SCHD-7704] permission checks and minor code cleanups

Browse Source
This commit is contained in:
Michael Boelen 2017-03-13 12:00:27 +01:00
parent 320a397772
commit 6083f6d9ff
1 changed files with 72 additions and 65 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
include/tests_scheduling
View File

@ -36,7 +36,7 @@
Register --test-no SCHD-7702 --weight L --network NO --category security --description "Check status of cron daemon" Register --test-no SCHD-7702 --weight L --network NO --category security --description "Check status of cron daemon"
if [ ${SKIPTEST} -eq 0 ]; then if [ ${SKIPTEST} -eq 0 ]; then
FIND=$(${PSBINARY} aux | ${EGREPBINARY} "( cron$|/cron(d)? )") FIND=$(${PSBINARY} aux | ${EGREPBINARY} "( cron$|/cron(d)? )")
if [ "${FIND}" = "" ]; then if [ -z "${FIND}" ]; then
LogText "Result: no cron daemon found" LogText "Result: no cron daemon found"
else else
LogText "Result: cron daemon running" LogText "Result: cron daemon running"
@ -73,8 +73,7 @@
for I in ${CRON_DIRS}; do for I in ${CRON_DIRS}; do
LogText "Test: checking directory ${I}" LogText "Test: checking directory ${I}"
if [ -d ${I} ]; then if [ -d ${I} ]; then
FileIsReadable ${I} if FileIsReadable ${I}; then
if [ ${CANREAD} -eq 1 ]; then
LogText "Result: found directory ${I}" LogText "Result: found directory ${I}"
LogText "Test: searching files in ${I}" LogText "Test: searching files in ${I}"
FIND=$(find ${I} -type f -print | ${GREPBINARY} -v ".placeholder") FIND=$(find ${I} -type f -print | ${GREPBINARY} -v ".placeholder")
@ -108,8 +107,9 @@
LogText "Test: checking directory ${I}" LogText "Test: checking directory ${I}"
if [ -d ${I} ]; then if [ -d ${I} ]; then
LogText "Result: found directory ${I}" LogText "Result: found directory ${I}"
if FileIsReadable ${I}; then
LogText "Test: searching files in ${I}" LogText "Test: searching files in ${I}"
FIND=$(find ${I} -type f -print | ${GREPBINARY} -v ".placeholder") FIND=$(find ${I} -type f -print 2> /dev/null | ${GREPBINARY} -v ".placeholder")
if [ "${FIND}" = "" ]; then if [ "${FIND}" = "" ]; then
LogText "Result: no files found in ${I}" LogText "Result: no files found in ${I}"
else else
@ -122,6 +122,9 @@
done done
LogText "Result: done with analyzing files in ${I}" LogText "Result: done with analyzing files in ${I}"
fi fi
else
LogText "Result: directory permissions are too strict to enter it (which might be good)"
fi
else else
LogText "Result: directory ${I} does not exist" LogText "Result: directory ${I} does not exist"
fi fi
@ -130,23 +133,27 @@
# /var/spool/cron/* and /var/spool/cron/crontabs/* # /var/spool/cron/* and /var/spool/cron/crontabs/*
# Search only in one tree, to avoid searching the tree twice # Search only in one tree, to avoid searching the tree twice
if [ -d /var/spool/cron/crontabs ]; then if [ -d /var/spool/cron/crontabs ]; then
FIND=$(find /var/spool/cron/crontabs -type f -print) FIND=$(${FINDBINARY} /var/spool/cron/crontabs -xdev -type f -print 2> /dev/null)
for I in ${FIND}; do for I in ${FIND}; do
if FileIsReadable ${I}; then
FindCronJob ${I} FindCronJob ${I}
for J in ${sCRONJOBS}; do for J in ${sCRONJOBS}; do
LogText "Found cronjob (/var/spool/cron/crontabs): ${I} (${J})" LogText "Found cronjob (/var/spool/cron/crontabs): ${I} (${J})"
Report "cronjob[]=${I}" Report "cronjob[]=${I}"
done done
fi
done done
else else
if [ -d /var/spool/cron ]; then if [ -d /var/spool/cron ]; then
FIND=$(find /var/spool/cron -type f -print) FIND=$(find /var/spool/cron -type f -print)
for I in ${FIND}; do for I in ${FIND}; do
if FileIsReadable ${I}; then
FindCronJob ${I} FindCronJob ${I}
for J in ${sCRONJOBS}; do for J in ${sCRONJOBS}; do
LogText "Found cronjob (/var/spool/cron): ${I} (${J})" LogText "Found cronjob (/var/spool/cron): ${I} (${J})"
LogText "cronjob[]=${I}" LogText "cronjob[]=${I}"
done done
fi
done done
fi fi
fi fi
@ -156,11 +163,11 @@
if [ -f /etc/anacrontab ]; then if [ -f /etc/anacrontab ]; then
LogText "Test: checking anacrontab" LogText "Test: checking anacrontab"
sANACRONJOBS=$(${EGREPBINARY} '^([0-9@])' /etc/anacrontab | ${TRBINARY} '\t' ' ' | ${TRBINARY} -s ' ' | ${TRBINARY} ' ' ',') sANACRONJOBS=$(${EGREPBINARY} '^([0-9@])' /etc/anacrontab | ${TRBINARY} '\t' ' ' | ${TRBINARY} -s ' ' | ${TRBINARY} ' ' ',')
if [ ! "${sANACRONJOBS}" = "" ]; then if [ ! -z "${sANACRONJOBS}" ]; then
Report "scheduler[]=anacron" Report "scheduler[]=anacron"
for J in ${sANACRONJOBS}; do for I in ${sANACRONJOBS}; do
LogText "Found anacron job (/etc/anacrontab): ${J}" LogText "Found anacron job (/etc/anacrontab): ${I}"
Report "cronjob[]=${J}" Report "cronjob[]=${I}"
done done
fi fi
fi fi
@ -187,7 +194,7 @@
if [ ${SKIPTEST} -eq 0 ]; then if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Checking atd status" LogText "Test: Checking atd status"
FIND=$(${PSBINARY} ax | ${GREPBINARY} "/atd" | ${GREPBINARY} -v "grep") FIND=$(${PSBINARY} ax | ${GREPBINARY} "/atd" | ${GREPBINARY} -v "grep")
if [ ! "${FIND}" = "" ]; then if [ ! -z "${FIND}" ]; then
LogText "Result: at daemon active" LogText "Result: at daemon active"
Display --indent 2 --text "- Checking atd status" --result "${STATUS_RUNNING}" --color GREEN Display --indent 2 --text "- Checking atd status" --result "${STATUS_RUNNING}" --color GREEN
ATD_RUNNING=1 ATD_RUNNING=1