tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-27 07:44:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Do an earlier detection of grsecurity and store result, so tests can be simplified

Browse Source
This commit is contained in:
Michael Boelen 2016-05-03 10:58:05 +02:00
parent 89e16443a9
commit 924e53ed76
5 changed files with 9 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/consts
View File

@ -83,8 +83,9 @@ unset LANG
FIREWALL_ACTIVE=0 FIREWALL_ACTIVE=0
FOUNDPATH=0 FOUNDPATH=0
GREPBINARY="grep" GREPBINARY="grep"
GRPCKBINARY=""
GROUP_NAME="" GROUP_NAME=""
GRPCKBINARY=""
GRSEC_FOUND=0
GRUB2INSTALLBINARY="" GRUB2INSTALLBINARY=""
HAS_SYSTEMD=0 HAS_SYSTEMD=0
HELPER="" HELPER=""

1
include/osdetection
View File

@ -113,6 +113,7 @@
FIND_BINARIES="whereis -b" FIND_BINARIES="whereis -b"
OS_KERNELVERSION_FULL=`uname -r` OS_KERNELVERSION_FULL=`uname -r`
OS_KERNELVERSION=`echo ${OS_KERNELVERSION_FULL} | sed 's/-.*//'` OS_KERNELVERSION=`echo ${OS_KERNELVERSION_FULL} | sed 's/-.*//'`
if [ -e /dev/grsec ]; then GRSEC_FOUND=1; fi
# Amazon # Amazon
if [ -e "/etc/system-release" ]; then if [ -e "/etc/system-release" ]; then

0
include/tests_custom Normal file
View File

2
include/tests_logging
View File

@ -477,7 +477,7 @@
LogText "Test: checking deleted files that are still in use" LogText "Test: checking deleted files that are still in use"
LSOF_GREP="WARNING|Output information" LSOF_GREP="WARNING|Output information"
if [ ${GRSECFOUND} -eq 1 ]; then if [ ${GRSEC_FOUND} -eq 1 ]; then
# grsecurity causes Fail2Ban to hold onto deleted in-use files in /var/tmp # grsecurity causes Fail2Ban to hold onto deleted in-use files in /var/tmp
LSOF_GREP="${LSOF_GREP}|fail2ban" LSOF_GREP="${LSOF_GREP}|fail2ban"
fi fi

19
include/tests_mac_frameworks
View File

@ -19,7 +19,6 @@
################################################################################# #################################################################################
# #
APPARMORFOUND=0 # Set default for test MACF-6208 APPARMORFOUND=0 # Set default for test MACF-6208
GRSECFOUND=0 # grsecurity
MAC_FRAMEWORK_ACTIVE=0 # Default no MAC framework active MAC_FRAMEWORK_ACTIVE=0 # Default no MAC framework active
RBAC_FRAMEWORK_ACTIVE=0 # Default no RBAC framework active RBAC_FRAMEWORK_ACTIVE=0 # Default no RBAC framework active
SELINUXFOUND=0 SELINUXFOUND=0
@ -137,28 +136,20 @@
# #
# Test : RBAC-6272 # Test : RBAC-6272
# Description : Check if grsecurity is installed # Description : Check if grsecurity is installed
# Notes : Solaris doesn't support test -e # Notes : We already checked grsecurity in osdetection
if [ ! "${OS}" = "Solaris" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no RBAC-6272 --weight L --network NO --description "Check grsecurity presence"
Register --test-no RBAC-6272 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check grsecurity presence"
if [ ${SKIPTEST} -eq 0 ]; then if [ ${SKIPTEST} -eq 0 ]; then
if [ -e /dev/grsec ]; then
GRSECFOUND=1
LogText "Result: grsecurity available (/dev/grsec found)"
else
LogText "Result: grsecurity not present (/dev/grsec not found)"
fi
# Check Linux kernel configuration # Check Linux kernel configuration
if [ ! "${LINUXCONFIGFILE}" = "" -a -f "${LINUXCONFIGFILE}" ]; then if [ ! "${LINUXCONFIGFILE}" = "" -a -f "${LINUXCONFIGFILE}" ]; then
FIND=`${GREPBINARY} ^CONFIG_GRKERNSEC=y ${LINUXCONFIGFILE}` FIND=`${GREPBINARY} ^CONFIG_GRKERNSEC=y ${LINUXCONFIGFILE}`
if [ ! "${FIND}" = "" ]; then if [ ! "${FIND}" = "" ]; then
LogText "Result: grsecurity available (in kernel config)" LogText "Result: grsecurity available (in kernel config)"
GRSECFOUND=1 GRSEC_FOUND=1
else else
LogText "Result: no grsecurity found in kernel config" LogText "Result: no grsecurity found in kernel config"
fi fi
fi fi
# Found grsecurity? if [ ${GRSEC_FOUND} -eq 1 ]; then
if [ ${GRSECFOUND} -eq 1 ]; then
Display --indent 2 --text "- Checking presence grsecurity" --result FOUND --color GREEN Display --indent 2 --text "- Checking presence grsecurity" --result FOUND --color GREEN
AddHP 3 3 AddHP 3 3
else else
@ -186,7 +177,7 @@
################################################################################# #################################################################################
# #
Report "framework_grsecurity=${GRSECFOUND}" Report "framework_grsecurity=${GRSEC_FOUND}"
Report "framework_selinux=${SELINUXFOUND}" Report "framework_selinux=${SELINUXFOUND}"
WaitForKeyPress WaitForKeyPress