tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-29 16:54:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

[FILE-6398] Only perform test if we know if Linux kernel is monolithic/modular

Browse Source
This commit is contained in:
Michael Boelen 2024-09-30 10:00:55 +00:00
parent fb5b808944
commit 699ec384d2
No known key found for this signature in database
GPG Key ID: 26141F77A09D7F04
3 changed files with 33 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/consts
View File

@ -172,6 +172,7 @@ ETC_PATHS="/etc /usr/local/etc"
MDATPBINARY="" MDATPBINARY=""
MIN_PASSWORD_LENGTH=-1 MIN_PASSWORD_LENGTH=-1
MONGODB_RUNNING=0 MONGODB_RUNNING=0
MONOLITHIC_KERNEL_TESTED=0
MOUNTBINARY="" MOUNTBINARY=""
MTREEBINARY="" MTREEBINARY=""
MYSQLCLIENTBINARY="" MYSQLCLIENTBINARY=""

57
include/tests_filesystems
View File

@ -738,37 +738,42 @@
if [ ${SKIPTEST} -eq 0 ]; then if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Checking if JBD (Journal Block Device) driver is loaded" LogText "Test: Checking if JBD (Journal Block Device) driver is loaded"
NOTINUSE=0 NOTINUSE=0
# Cannot check if driver is loaded/present if kernel is monolithic # Only perform testing if we know that KRNL-5723 performed tests
if [ ${MONOLITHIC_KERNEL} -eq 0 ]; then if [ ${MONOLITHIC_KERNEL_TESTED} -eq 1 ]; then
JBD=$(${LSMODBINARY} | ${GREPBINARY} ^jbd) # Cannot check if driver is loaded/present if kernel is monolithic
if [ -n "${JBD}" ]; then if [ ${MONOLITHIC_KERNEL} -eq 0 ]; then
LogText "Result: JBD driver is loaded" JBD=$(${LSMODBINARY} | ${GREPBINARY} ^jbd)
INUSE=$(echo ${JBD} | ${AWKBINARY} '{if ($3 -ne 0) {print $4}}') if [ -n "${JBD}" ]; then
if [ -n "${INUSE}" ]; then LogText "Result: JBD driver is loaded"
LogText "Result: JBD driver is in use by drivers: ${INUSE}" INUSE=$(echo ${JBD} | ${AWKBINARY} '{if ($3 -ne 0) {print $4}}')
Report "JBD driver is in use by drivers: ${INUSE}" if [ -n "${INUSE}" ]; then
Display --indent 2 --text "- JBD driver loaded and in use" --result "${STATUS_OK}" --color GREEN LogText "Result: JBD driver is in use by drivers: ${INUSE}"
Report "JBD driver is in use by drivers: ${INUSE}"
Display --indent 2 --text "- JBD driver loaded and in use" --result "${STATUS_OK}" --color GREEN
else
NOTINUSE=1
LogText "Result: JBD driver loaded, but not in use"
Report "JBD driver is loaded, but not in use."
Display --indent 2 --text "- JBD driver loaded, but not in use" --result "${STATUS_SUGGESTION}" --color YELLOW
fi
else else
NOTINUSE=1 NOTINUSE=2
LogText "Result: JBD driver loaded, but not in use" LogText "Result: JBD driver not loaded"
Report "JBD driver is loaded, but not in use." Report "JBD driver not loaded."
Display --indent 2 --text "- JBD driver loaded, but not in use" --result "${STATUS_SUGGESTION}" --color YELLOW Display --indent 2 --text "- JBD driver is not loaded" --result "${STATUS_CHECK_NEEDED}" --color YELLOW
fi
if [ ${NOTINUSE} -eq 1 ]; then
ReportSuggestion "${TEST_NO}" "The JBD (Journal Block Device) driver is loaded but not in use." "You are currently not using any filesystems with journaling, i.e. you have greater risk of data corruption in case of system crash."
elif [ ${NOTINUSE} -eq 2 ]; then
ReportSuggestion "${TEST_NO}" "The JBD (Journal Block Device) driver is not loaded." "Since boot-time, you have not been using any filesystems with journaling. Alternatively, reason could be driver is blacklisted."
fi fi
else else
NOTINUSE=2 Display --indent 2 --text "- JBD driver: unable to check" --result "${STATUS_UNKNOWN}" --color YELLOW
LogText "Result: JBD driver not loaded" LogText "Kernel is monolithic - cannot check if JBD driver is part of compiled kernel."
Report "JBD driver not loaded."
Display --indent 2 --text "- JBD driver is not loaded" --result "${STATUS_CHECK_NEEDED}" --color YELLOW
fi
if [ ${NOTINUSE} -eq 1 ]; then
ReportSuggestion "${TEST_NO}" "The JBD (Journal Block Device) driver is loaded but not in use." "You are currently not using any filesystems with journaling, i.e. you have greater risk of data corruption in case of system crash."
elif [ ${NOTINUSE} -eq 2 ]; then
ReportSuggestion "${TEST_NO}" "The JBD (Journal Block Device) driver is not loaded." "Since boot-time, you have not been using any filesystems with journaling. Alternatively, reason could be driver is blacklisted."
fi fi
else else
LogText "Kernel is monolithic - cannot check if JBD driver is part of compiled kernel." Display --indent 2 --text "- JBD driver: test skipped" --result "${STATUS_UNKNOWN}" --color YELLOW
Report "Kernel is monolithic - cannot check if JBD driver is part of compiled kernel." LogText "Test skipped as the kernel type (monolithic/modular) is unknown"
Display --indent 2 --text "- JBD driver: unable to check" --result "${STATUS_UNKNOWN}" --color RED
fi fi
fi fi
# #

1
include/tests_kernel
View File

@ -176,6 +176,7 @@
# Checking if any modules are loaded # Checking if any modules are loaded
FIND=$(${LSMODBINARY} | ${GREPBINARY} -v "^Module" | wc -l | ${TRBINARY} -s ' ' | ${TRBINARY} -d ' ') FIND=$(${LSMODBINARY} | ${GREPBINARY} -v "^Module" | wc -l | ${TRBINARY} -s ' ' | ${TRBINARY} -d ' ')
Display --indent 2 --text "- Checking kernel type" --result "${STATUS_DONE}" --color GREEN Display --indent 2 --text "- Checking kernel type" --result "${STATUS_DONE}" --color GREEN
MONOLITHIC_KERNEL_TESTED=1
if [ "${FIND}" = "0" ]; then if [ "${FIND}" = "0" ]; then
LogText "Result: Found monolithic kernel" LogText "Result: Found monolithic kernel"
Report "linux_kernel_type=monolithic" Report "linux_kernel_type=monolithic"