mirror of https://github.com/CISOfy/lynis.git
Lots of cleanups (#366)
* Description fix: SafePerms works on files not dirs.
All uses of SafePerms are on files (and indeed, it would reject
directories which would have +x set).
* Lots of whitespace cleanups.
Enforce everywhere(?) the same indentations for if/fi blocks.
The standard for the Lynis codebase is 4 spaces. But sometimes
it's 1, sometimes 3, sometimes 8.
These patches standardize all(?) if blocks but _not_ else's (which
are usually indented 2, but sometimes zero); I was too lazy to
identify those (see below).
This diff is giant, but should not change code behavior at all;
diff -w shows no changes apart from whitespace.
FWIW I identified instances to check by using:
perl -ne 'if ($oldfile ne $ARGV) { $.=1; $oldfile=$ARGV; }; chomp; if ($spaces) { next unless /^( *)([^ ]+)/; $newspaces=length($1); $firsttok = $2; next unless defined($firsttok); $offset = ($firsttok eq "elif" ? 0 : 4); if ($newspaces != $spaces + $offset) { print "$ARGV:$ifline\n$ARGV:$.:$_\n\n" }; $ifline=""; $spaces=""; } if (/^( *)if (?!.*[; ]fi)/) { $ifline = "$.:$_"; $spaces = length($1); }' $(find . -type f -print0 | xargs -0 file | egrep shell | cut -d: -f1)
Which produced output like:
./extras/build-lynis.sh:217: if [ ${VERSION_IN_SPECFILE} = "" -o ! "${VERSION_IN_SPECFILE}" = "${LYNIS_VERSION}" ]; then
./extras/build-lynis.sh:218: echo "[X] Version in specfile is outdated"
./plugins/plugin_pam_phase1:69: if [ -d ${PAM_DIRECTORY} ]; then
./plugins/plugin_pam_phase1:70: LogText "Result: /etc/pam.d exists"
...There's probably formal shellscript-beautification tools that
I'm oblivious about.
* More whitespace standardization.
* Fix a syntax error.
This looks like an if [ foo -o bar ]; was converted to if .. elif,
but incompletely.
* Add whitespace before closing ].
Without it, the shell thinks the ] is part of the last string, and
emits warnings like:
.../lynis/include/tests_authentication: line 1028: [: missing `]'
This commit is contained in:
hlein
Michael Boelen
parent
7e915df1ee
commit
e054e9757c
|
|
@ -81,7 +81,7 @@
|
|||
# ReportManual Log manual actions to report file
|
||||
# ReportSuggestion Add a suggestion to report file
|
||||
# ReportWarning Add a warning and priority to report file
|
||||
# SafePerms Check if a directory has safe permissions
|
||||
# SafePerms Check if a file has safe permissions
|
||||
# SearchItem Search a string in a file
|
||||
# ShowComplianceFinding Display a particular finding regarding compliance or a security standard
|
||||
# ShowSymlinkPath Show a path behind a symlink
|
||||
|
|
|
|||
|
|
@ -996,7 +996,7 @@
|
|||
for FILE in ${FIND}; do
|
||||
HAS_MASK=$(${GREPBINARY} umask ${FILE} | ${SEDBINARY} 's/^[ \t]*//' | ${GREPBINARY} -v "^#" | ${AWKBINARY} '{ print $2 }')
|
||||
for MASK in ${HAS_MASK}; do
|
||||
if [ "${MASK}" = "077" -o "${MASK}" = "027" -o "${MASK}" = "0077" -o "${MASK}" = "0027"]; then
|
||||
if [ "${MASK}" = "077" -o "${MASK}" = "027" -o "${MASK}" = "0077" -o "${MASK}" = "0027" ]; then
|
||||
LogText "Result: found a strong umask '${MASK}' set in ${FILE}"
|
||||
GOOD_UMASK=1
|
||||
else
|
||||
|
|
@ -1025,7 +1025,7 @@
|
|||
elif [ "${FIND2}" = "1" ]; then
|
||||
LogText "Result: found umask (prefixed with spaces)"
|
||||
FOUND_UMASK=1
|
||||
if [ ! "${FIND}" = "077" -a ! "${FIND}" = "027" -a ! "${FIND}" = "0077" -a ! "${FIND}" = "0027"]; then
|
||||
if [ ! "${FIND}" = "077" -a ! "${FIND}" = "027" -a ! "${FIND}" = "0077" -a ! "${FIND}" = "0027" ]; then
|
||||
LogText "Result: found umask ${FIND}, which could be more strict"
|
||||
WEAK_UMASK=1
|
||||
else
|
||||
|
|
@ -1037,7 +1037,7 @@
|
|||
LogText "Result: found multiple umask values configured in /etc/profile"
|
||||
FOUND_UMASK=1
|
||||
for I in ${FIND}; do
|
||||
if [ ! "${I}" = "077" -a ! "${I}" = "027" -a ! "${I}" = "0077" -a ! "${I}" = "0027"]; then
|
||||
if [ ! "${I}" = "077" -a ! "${I}" = "027" -a ! "${I}" = "0077" -a ! "${I}" = "0027" ]; then
|
||||
LogText "Result: umask ${I} could be more strict"
|
||||
WEAK_UMASK=1
|
||||
AddHP 1 2
|
||||
|
|
@ -1094,7 +1094,7 @@
|
|||
Display --indent 4 --text "- umask (/etc/login.defs)" --result "${STATUS_SUGGESTION}" --color YELLOW
|
||||
ReportSuggestion ${TEST_NO} "Default umask in /etc/login.defs could not be found and defaults usually to 022, which could be more strict like 027"
|
||||
AddHP 1 2
|
||||
elif [ "${FIND}" = "077" -o "${FIND}" = "027" -o "${FIND}" = "0077" -o "${FIND}" = "0027"]; then
|
||||
elif [ "${FIND}" = "077" -o "${FIND}" = "027" -o "${FIND}" = "0077" -o "${FIND}" = "0027" ]; then
|
||||
LogText "Result: umask is ${FIND}, which is fine"
|
||||
Display --indent 4 --text "- umask (/etc/login.defs)" --result "${STATUS_OK}" --color GREEN
|
||||
AddHP 2 2
|
||||
|
|
@ -1117,7 +1117,7 @@
|
|||
if [ "${FIND}" = "" ]; then
|
||||
LogText "Result: umask is not configured"
|
||||
Display --indent 4 --text "- umask (/etc/init.d/functions)" --result "${STATUS_NONE}" --color WHITE
|
||||
elif [ "${FIND}" = "077" -o "${FIND}" = "027" -o "${FIND}" = "0077" -o "${FIND}" = "0027"]; then
|
||||
elif [ "${FIND}" = "077" -o "${FIND}" = "027" -o "${FIND}" = "0077" -o "${FIND}" = "0027" ]; then
|
||||
LogText "Result: umask is ${FIND}, which is fine"
|
||||
Display --indent 4 --text "- umask (/etc/init.d/functions)" --result "${STATUS_OK}" --color GREEN
|
||||
AddHP 2 2
|
||||
|
|
@ -1141,7 +1141,7 @@
|
|||
Display --indent 4 --text "- Checking umask (/etc/init.d/rc)" --result "${STATUS_SUGGESTION}" --color YELLOW
|
||||
ReportSuggestion ${TEST_NO} "Default umask in /etc/init.d/rc could not be found and defaults usually to 022, which could be more strict like 027"
|
||||
AddHP 1 2
|
||||
elif [ "${FIND}" = "077" -o "${FIND}" = "027" -o "${FIND}" = "0077" -o "${FIND}" = "0027"]; then
|
||||
elif [ "${FIND}" = "077" -o "${FIND}" = "027" -o "${FIND}" = "0077" -o "${FIND}" = "0027" ]; then
|
||||
LogText "Result: umask is ${FIND}, which is fine"
|
||||
Display --indent 4 --text "- umask (/etc/init.d/rc)" --result "${STATUS_OK}" --color GREEN
|
||||
AddHP 2 2
|
||||
|
|
|
|||
|
|
@ -388,7 +388,7 @@
|
|||
ReportSuggestion ${TEST_NO} "Add a password to LILO, by adding a line to the lilo.conf file, above the first line saying 'image=<name>': password=<password>"
|
||||
ReportWarning ${TEST_NO} "No password set on LILO bootloader"
|
||||
AddHP 0 2
|
||||
elif [ "${MACHINE_ROLE}" = "personal"]; then
|
||||
elif [ "${MACHINE_ROLE}" = "personal" ]; then
|
||||
Display --indent 4 --text "- Password option presence " --result "${STATUS_WARNING}" --color yellow
|
||||
LogText "Result: no password set for LILO. Bootloader is unprotected to dropping to single user mode or unauthorized access to devices/data."
|
||||
ReportSuggestion ${TEST_NO} "No password set on LILO bootloader. Add a password to LILO, by adding a line to the lilo.conf file, above the first line saying 'image=<name>': password=<password>"
|
||||
|
|
|
|||
|
|
@ -173,7 +173,7 @@
|
|||
PAM_2F_AUTH_REQUIRED=1
|
||||
Report "authentication_2f_provider[]=${PAM_MODULE_NAME}"
|
||||
Report "authentication_2f_service[]=${PAM_SERVICE}"
|
||||
elif -o "${PAM_CONTROL_FLAG}" = "sufficient" ]; then
|
||||
elif [ "${PAM_CONTROL_FLAG}" = "sufficient" ]; then
|
||||
PAM_2F_AUTH_ENABLED=1
|
||||
Report "authentication_2f_provider[]=${PAM_MODULE_NAME}"
|
||||
Report "authentication_2f_service[]=${PAM_SERVICE}"
|
||||
|
|
@ -460,7 +460,7 @@ if [ ${PAM_PASSWORD_PWHISTORY_ENABLED} -eq 1 ]; then
|
|||
LogText "[PAM] Password history with pam_pwhistory enabled: ${PAM_PASSWORD_PWHISTORY_ENABLED}"
|
||||
LogText "[PAM] Password history with pam_pwhistory amount: ${PAM_PASSWORD_PWHISTORY_AMOUNT}"
|
||||
Report "password_history_amount=${PAM_PASSWORD_PWHISTORY_AMOUNT}"
|
||||
else
|
||||
else
|
||||
LogText "[PAM] Password history with pam_pwhistory IS NOT enabled"
|
||||
fi
|
||||
|
||||
|
|
@ -468,7 +468,7 @@ if [ ${PAM_PASSWORD_UXHISTORY_ENABLED} -eq 1 ]; then
|
|||
LogText "[PAM] Password history with pam_unix enabled: ${PAM_PASSWORD_UXHISTORY_ENABLED}"
|
||||
LogText "[PAM] Password history with pam_unix amount: ${PAM_PASSWORD_UXHISTORY_AMOUNT}"
|
||||
Report "password_history_amount=${PAM_PASSWORD_UXHISTORY_AMOUNT}"
|
||||
else
|
||||
else
|
||||
LogText "[PAM] Password history with pam_unix IS NOT enabled"
|
||||
fi
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue