tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1205 from kolenichsj/alpine_apk 

Adding support for Alpine Package Keeper
This commit is contained in:
Michael Boelen 2022-02-10 12:00:38 +01:00 committed by GitHub
parent e0b5dcf7d4 eb46f39c44
commit cd433e928e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 68 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/binaries
View File

@ -134,6 +134,7 @@
aide) AIDEBINARY=${BINARY}; LogText " Found known binary: aide (file integrity checker) - ${BINARY}" ;;
apache2) HTTPDBINARY=${BINARY}; LogText " Found known binary: apache2 (web server) - ${BINARY}" ;;
apt) APTBINARY=${BINARY}; LogText " Found known binary: apt (package manager) - ${BINARY}" ;;
apk) APKBINARY=${BINARY}; LogText " Found known binary: apk (package manager) - ${BINARY}" ;;
arch-audit) ARCH_AUDIT_BINARY="${BINARY}"; LogText " Found known binary: arch-audit (auditing utility to test for vulnerable packages) - ${BINARY}" ;;
auditd) AUDITDBINARY=${BINARY}; LogText " Found known binary: auditd (audit framework) - ${BINARY}" ;;
awk) AWKBINARY=${BINARY}; LogText " Found known binary: awk (string tool) - ${BINARY}" ;;

1
include/consts
View File

@ -43,6 +43,7 @@ ETC_PATHS="/etc /usr/local/etc"
# == Variable initializing ==
#
APTBINARY=""
APKBINARY=""
ARCH_AUDIT_BINARY=""
AUDITORNAME=""
AUDITCTLBINARY=""

3
include/functions
View File

@ -2098,6 +2098,9 @@
elif [ -n "${XBPSBINARY}" ]; then
output=$(${XBPSBINARY} ${package} 2> /dev/null | ${GREPBINARY} "^ii")
exit_code=$?
elif [ -n "${APKBINARY}" ]; then
output=$(${APKBINARY} search ${package} 2> /dev/null | ${GREPBINARY} ${package})
exit_code=$?
else
if [ "${package}" != "__dummy__" ]; then
ReportException "PackageIsInstalled:01 (test=${TEST_NO:-unknown})"

63
include/tests_ports_packages
View File

@ -466,6 +466,34 @@
fi
#
#################################################################################
#
# Test : PKGS-7346
# Description : Check Alpine Package Keeper (apk)
if [ -x ${ROOTDIR}/sbin/apk ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7346 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Querying apk"
if [ ${SKIPTEST} -eq 0 ]; then
COUNT=0
Display --indent 4 --text "- Searching apk package manager" --result "${STATUS_FOUND}" --color GREEN
LogText "Result: Found apk binary"
Report "package_manager[]=apk"
PACKAGE_MGR_PKG=1
LogText "Test: Querying apk info -v to get package list"
Display --indent 6 --text "- Querying package manager"
LogText "Output:"
SPACKAGES=$(apk info -v | ${SEDBINARY} -r -e 's/([a-z,A-Z,0-9,_,-,.]{1,250})-([a-z,A-Z,0-9,.]+-r[a-z,A-Z,0-9]+)/\1,\2/' | sort)
for J in ${SPACKAGES}; do
COUNT=$((COUNT + 1))
PACKAGE_NAME=$(echo ${J} | ${CUTBINARY} -d ',' -f1)
PACKAGE_VERSION=$(echo ${J} | ${CUTBINARY} -d ',' -f2)
LogText "Found package: ${PACKAGE_NAME} (version: ${PACKAGE_VERSION})"
INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${PACKAGE_NAME},${PACKAGE_VERSION}"
done
Report "installed_packages=${COUNT}"
else
LogText "Result: apk "${STATUS_NOT_FOUND}", test skipped"
fi
#
#################################################################################
#
# Test : PKGS-7346
# Description : Check packages which are removed, but still own configuration files, cron jobs etc
@ -1235,6 +1263,41 @@
#
#################################################################################
#
# Test : PKGS-7395
# Description : Check Alpine upgradeable packages
if [ "${LINUX_VERSION}" = "Alpine Linux" ] && [ -x "${ROOTDIR}sbin/apk" ]; then
PREQS_MET="YES"
else
PREQS_MET="NO"
fi
Register --test-no PKGS-7395 --os Linux --preqs-met ${PREQS_MET} --weight L --network YES --category security --description "Check for Alpine updates"
if [ ${SKIPTEST} -eq 0 ]; then
if [ ${REFRESH_REPOSITORIES} -eq 1 ]; then
LogText "Action: updating package repository with apk"
${ROOTDIR}sbin/apk update
LogText "Result: apk finished"
else
LogText "Result: using a possibly outdated repository, as updating is disabled via configuration"
fi
LogText "Test: Checking packages which can be upgraded via apk version -l '<'"
FIND=$(${ROOTDIR}sbin/apk version -l '<' | ${GREPBINARY} '<' | ${SEDBINARY} 's/\s\+<\s/</g')
if [ -z "${FIND}" ]; then
LogText "Result: no packages found which can be upgraded"
Display --indent 2 --text "- Checking upgradeable packages" --result "${STATUS_NONE}" --color GREEN
AddHP 3 3
else
LogText "Result: found one or more packages which can be upgraded"
Display --indent 2 --text "- Checking upgradeable packages" --result "${STATUS_FOUND}" --color YELLOW
for ITEM in ${FIND}; do
ITEM=$(echo ${ITEM} | ${SEDBINARY} -r -e 's/([a-z,A-Z,0-9,_,-,.]{1,250})-([a-z,A-Z,0-9,.]+-r[a-z,A-Z,0-9]+)<([a-z,A-Z,0-9,-,.]+)/\1 from \2 to \3/')
LogText "${ITEM}"
done
fi
fi
#
#################################################################################
#
# Test : PKGS-7398
# Description : Check package audit tool