tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-29 00:34:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Improve output of tests related to file permissions

Browse Source
This commit is contained in:
mboelen 2015-04-19 22:10:51 +02:00
parent a6290d1bec
commit f8f4862244
1 changed files with 34 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
lynis
View File

@ -22,8 +22,8 @@
# #
# Program information # Program information
PROGRAM_name="Lynis" PROGRAM_name="Lynis"
PROGRAM_version="2.1.0" PROGRAM_version="2.1.1"
PROGRAM_releasedate="16 April 2015" PROGRAM_releasedate="19 April 2015"
PROGRAM_author="CISOfy" PROGRAM_author="CISOfy"
PROGRAM_author_contact="lynis-dev@cisofy.com" PROGRAM_author_contact="lynis-dev@cisofy.com"
PROGRAM_website="https://cisofy.com" PROGRAM_website="https://cisofy.com"
@ -98,14 +98,26 @@
if [ ! "${PERMS2}" = "r--------" -a ! "${PERMS2}" = "rw-------" -a ! "${PERMS}" = "rw-r-----" -a ! "${PERMS}" = "rw-r--r--" ]; then if [ ! "${PERMS2}" = "r--------" -a ! "${PERMS2}" = "rw-------" -a ! "${PERMS}" = "rw-r-----" -a ! "${PERMS}" = "rw-r--r--" ]; then
ISSUE=1; echo "[!] Change file permissions of ${INCLUDEDIR}/functions to 640."; echo " Command: chmod 640 ${INCLUDEDIR}/functions" ISSUE=1; echo "[!] Change file permissions of ${INCLUDEDIR}/functions to 640."; echo " Command: chmod 640 ${INCLUDEDIR}/functions"
fi fi
# Check if owner of both files is root user, or the same user which is running Lynis (for pentester mode) # Check if owner of both files is root user, or the same user which is running Lynis (for pentester mode)
if [ ! "${OWNER}" = "root" -a ! "${OWNERID}" = "0" -a ! "${MYID}" = "${OWNER2ID}" ]; then
ISSUE=1; echo "[!] Change ownership of ${INCLUDEDIR}/consts to 'root' or similar (found: ${OWNER} with UID ${OWNERID})."; echo " Command: chown root:root ${INCLUDEDIR}/consts" # Consts
fi if [ ! "${OWNER}" = "root" -a ! "${OWNERID}" = "0" ]; then ISSUE=1; SHOWPERMERROR=1; FILE="consts"; fi
# Check if owner of both files is root user, or the same user which is running Lynis (for pentester mode) if [ ! "${MYID}" = "${OWNER2ID}" ]; then ISSUE=1; SHOWPERMERROR=1; FILE="consts"; fi
if [ ! "${OWNER2}" = "root" -a ! "${OWNER2ID}" = "0" -a ! "${MYID}" = "${OWNER2ID}" ]; then # Functions
ISSUE=1; echo "[!] Change ownership of ${INCLUDEDIR}/functions to 'root' or similar (found: ${OWNER2} with UID ${OWNER2ID})."; echo " Command: chown root:root ${INCLUDEDIR}/functions" if [ ! "${OWNER2}" = "root" -a ! "${OWNER2ID}" = "0" ]; then ISSUE=1; SHOWPERMERROR=1; FILE="functions"; fi
fi if [ ! "${MYID}" = "${OWNER2ID}" ]; then ISSUE=1; SHOWPERMERROR=1; FILE="functions"; fi
if [ ${SHOWPERMERROR} -eq 1 ]; then
echo ""
echo "[!] Change ownership of ${INCLUDEDIR}/${FILE} to 'root' or similar (found: ${OWNER} with UID ${OWNERID})."
echo ""
echo " Command:"
echo " # chown root:root ${INCLUDEDIR}/${FILE}"
echo ""
echo " Note: on some systems the default group might be 'wheel'. Use 'chown root:wheel' instead on the files."
echo ""
fi
if [ ${ISSUE} -eq 0 ]; then if [ ${ISSUE} -eq 0 ]; then
. ${INCLUDEDIR}/consts . ${INCLUDEDIR}/consts
@ -114,11 +126,21 @@
echo ""; echo ""; echo ""; echo "";
echo "[X] Security check failed: See action above, to correct this issue." echo "[X] Security check failed: See action above, to correct this issue."
echo "" echo ""
echo " Why:" echo " Why do I see this error?"
echo " -------------------------------"
echo " This error is a protection mechanism, to prevent root user from executing user created files." echo " This error is a protection mechanism, to prevent root user from executing user created files."
echo ""; echo ""
echo " What can I do?"
echo " ---------------------"
echo " 1) Check if a trusted user created the files (e.g. you, by using Git, Homebrew or similar)"
echo "" echo ""
echo " Possible action:" echo " 2) Change ownership and permissions of the related files (or full directory)."
echo " Change ownership and permissions of the related files, or full directory, and start Lynis again." echo ""
echo " Commands (full directory):"
echo " # cd .."
echo " # chown -R root:<GROUP TO WHICH ROOT BELONGS> lynis"
echo ""
echo " 3) Start Lynis again (cd lynis && ./lynis)."
echo ""; echo ""; echo ""; echo "";
exit 1 exit 1
fi fi