tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-04-08 17:15:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

added test FILE-6337: check if /proc mounted with hidepid=(1|2) (#225)

Browse Source 
to hide users' sensitive files in /proc from other users
  (see `man proc` for details)
This commit is contained in:
Lukas Pirl 2016-07-11 16:48:25 +02:00 committed by Michael Boelen
parent 62e6af17de
commit 9a5647f66c
1 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
include/tests_filesystems
View File

@ -290,6 +290,32 @@
fi
#
#################################################################################
#
# Test : FILE-6337
# Description : Check proc mount options (Linux >=3.3 only)
# Examples : proc /proc proc defaults,hidepid=2 0 0
# Goal : Users should not be able to see processes of other users
if [ -f /proc/version ] && [ "$(cat /proc/version | cut -d" " -f3)" \> "3.2" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no FILE-6337 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --description "Checking proc mount options"
if [ ${SKIPTEST} -eq 0 ]; then
# Proc should be mounted with 'hidepid=2' or 'hidepid=1' at least
LogText "Test: check proc mount with incorrect mount options"
FIND=`mount | grep proc | egrep -o "hidepid=[0-9]"`
if [ "${FIND}" = "hidepid=2" ]; then
Display --indent 2 --text "- Testing proc mount" --result "${STATUS_OK}" --color GREEN
LogText "Result: proc mount mounted with hidepid=2"
else
if [ "${FIND}" = "" ]; then
HIDEPID1_SUGGESTION=" (or at least hidepid=1)"
fi
Display --indent 2 --text "- Testing proc mount" --result "${STATUS_SUGGESTION}" --color YELLOW
LogText "Result: proc file system not mounted with option hidepid=2$HIDEPID1_SUGGESTION"
ReportSuggestion ${TEST_NO} "Consider mounting /proc via /etc/fstab with mount option hidepid=2$HIDEPID1_SUGGESTION"
fi
fi
#
#################################################################################
#
# Test : FILE-6354
# Description : Search files within /tmp which are older than 3 months