tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[KRNL-6000] Change test to allow parsing multiple profiles and storing more details

This commit is contained in:
mboelen 2016-04-13 16:13:04 +02:00
parent fdd20a324e
commit 9a0102384f
1 changed files with 26 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
include/tests_kernel_hardening
View File

@ -32,33 +32,39 @@
if [ ! "${SYSCTL_READKEY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no KRNL-6000 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check sysctl key pairs in scan profile"
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
N=0
Display --indent 2 --text "- Comparing sysctl key pairs with scan profile"
FIND=`grep "^sysctl:" ${PROFILE} | sed 's/ /:space:/g'`
for I in ${FIND}; do
tFINDkey=`echo ${I} | awk -F: '{ print $2 }'`
tFINDexpvalue=`echo ${I} | awk -F: '{ print $3 }'`
tFINDhp=`echo ${I} | awk -F: '{ print $4 }' | grep "[0-9]"`
tFINDdesc=`echo ${I} | awk -F: '{ print $5 }' | sed 's/:space:/ /g'`
tFINDcurvalue=`${SYSCTL_READKEY} ${tFINDkey} 2> /dev/null`
if [ ! "${tFINDcurvalue}" = "" ]; then
if [ "${tFINDexpvalue}" = "${tFINDcurvalue}" ]; then
LogText "Result: sysctl key ${tFINDkey} contains equal expected and current value (${tFINDexpvalue})"
Display --indent 4 --text "- ${tFINDkey} (exp: ${tFINDexpvalue})" --result OK --color GREEN
AddHP ${tFINDhp} ${tFINDhp}
for PROFILE in ${PROFILES}; do
FIND=`grep "^sysctl:" ${PROFILE} | sed 's/ /-space-/g'`
for I in ${FIND}; do
tFINDkey=`echo ${I} | awk -F: '{ print $2 }'`
tFINDexpvalue=`echo ${I} | awk -F: '{ print $3 }'`
tFINDhp=`echo ${I} | awk -F: '{ print $4 }' | grep "[0-9]"`
tFINDdesc=`echo ${I} | awk -F: '{ print $5 }' | sed 's/-space-/ /g'`
tFINDcurvalue=`${SYSCTL_READKEY} ${tFINDkey} 2> /dev/null`
if [ ! "${tFINDcurvalue}" = "" ]; then
if [ "${tFINDexpvalue}" = "${tFINDcurvalue}" ]; then
LogText "Result: sysctl key ${tFINDkey} contains equal expected and current value (${tFINDexpvalue})"
Display --indent 4 --text "- ${tFINDkey} (exp: ${tFINDexpvalue})" --result OK --color GREEN
AddHP ${tFINDhp} ${tFINDhp}
else
LogText "Result: sysctl key ${tFINDkey} has a different value than expected in scan profile. Expected=${tFINDexpvalue}, Real=${tFINDcurvalue}"
Display --indent 4 --text "- ${tFINDkey} (exp: ${tFINDexpvalue})" --result DIFFERENT --color RED
AddHP 0 ${tFINDhp}
FOUND=1
N=`expr ${N} + 1`
ReportDetails --test "${TEST_NO}" --key "-" --field "${tFINDkey}" --value "${tFINDcurvalue}" --preferredvalue "${tFINDexpvalue}" --description "${tFINDdesc}"
fi
else
LogText "Result: sysctl key ${tFINDkey} has a different value than expected in scan profile. Expected=${tFINDexpvalue}, Real=${tFINDcurvalue}"
Display --indent 4 --text "- ${tFINDkey} (exp: ${tFINDexpvalue})" --result DIFFERENT --color RED
AddHP 0 ${tFINDhp}
N=1
LogText "Result: key ${tFINDkey} does not exist on this machine"
fi
else
LogText "Result: key ${tFINDkey} does not exist on this machine"
fi
done
done
# Add suggestion if one or more sysctls have a different value than scan profile
if [ ${N} -eq 1 ]; then
if [ ${FOUND} -eq 1 ]; then
LogText "Result: found ${N} keys that can use tuning, according scan profile"
ReportSuggestion ${TEST_NO} "One or more sysctl values differ from the scan profile and could be tweaked"
fi
fi