elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-12-04 20:48:18 +01:00
Code Issues Packages Projects Releases Wiki Activity
master
debian-cis/tests/hardening/6.1.10_find_world_writable_file.sh

42 lines
1.6 KiB
Bash
Raw Permalink Normal View History

IMP(shellcheck): add prefix to define shell (SC2148)
2020-11-27 09:22:47 +01:00
# shellcheck shell=bash
IMP: new tag in file to tell that the script should pass shellcheck The `# run-shellchek` tag must be placed in the first 10 lines of the file
2019-01-24 11:11:08 +01:00
# run-shellcheck
IMP(test): Add feature to run functional tests in docker instance Add usecase in basename Add test files for checks with find command Always show logs FIX: run void script to generate config and avoid sed failure Update README with functional test description Add skeleton for functional test Add argument to launch only specific test suite Add support for debian8 and compulsory mention of debian version at launch Improve README Simplify test file syntax to avoid copy/paste mistake Add script that runs tests on all debian targets Improve run_all_target script with nowait and nodel options Add dockerfile for Buster pre-version Chore: Use getopt for options and reviewed code by shellcheck Add trap to ensure cleanup on exit/interrupt Remove quotes that lead to `less` misinterpretation of the filenames Set `local` for variables inside `test_audit` func Move functional assertion functions to dedicated file Add cleanup for logs and containers Improve cleanup, and now exits Apply shellcheck recommendations FIX: allow script to be run from anywhere (dirname $0) Changes to be committed: modified: README.md new file: src/skel.test new file: tests/docker/Dockerfile.debian10_20181226 new file: tests/docker/Dockerfile.debian8 new file: tests/docker/Dockerfile.debian9 new file: tests/docker_build_and_run_tests.sh new file: tests/hardening/12.10_find_suid_files.sh new file: tests/hardening/12.11_find_sgid_files.sh new file: tests/hardening/12.7_find_world_writable_file.sh new file: tests/hardening/12.8_find_unowned_files.sh new file: tests/hardening/12.9_find_ungrouped_files.sh new file: tests/hardening/2.17_sticky_bit_world_writable_folder.sh new file: tests/launch_tests.sh new file: tests/lib.sh new file: tests/run_all_targets.sh
2018-12-24 14:12:59 +01:00
test_audit() {
fix EXCEPTIONS management (#104) * FIX(1.1.21, 6.1.10) fix EXCEPTIONS management * Update changelog * Refactor test for 6.1.10-14
2021-06-02 13:47:19 +02:00
describe Running void to generate the conf file that will later be edited
# shellcheck disable=2154
Replace CIS_ROOT_DIR by a more flexible system (#204) * Replace CIS_ROOT_DIR by a more flexible system * Try to adapt the logic change to the functional tests
2023-09-25 14:24:01 +02:00
"${CIS_CHECKS_DIR}/${script}.sh" || true
fix EXCEPTIONS management (#104) * FIX(1.1.21, 6.1.10) fix EXCEPTIONS management * Update changelog * Refactor test for 6.1.10-14
2021-06-02 13:47:19 +02:00
# shellcheck disable=2016
Replace CIS_ROOT_DIR by a more flexible system (#204) * Replace CIS_ROOT_DIR by a more flexible system * Try to adapt the logic change to the functional tests
2023-09-25 14:24:01 +02:00
echo 'EXCLUDED="$EXCLUDED ^/home/secaudit/thisfileisignored.*|^/dev/.*"' >>"${CIS_CONF_DIR}/conf.d/${script}.cfg"
feat: Filter the filesystem to check when the list is built. (#156) * feat: Attempt to filter-out filesystem that match exclusion regex.
2022-06-24 17:45:47 +02:00
touch /home/secaudit/thisfileisignored
chmod 777 /home/secaudit/thisfileisignored
IMP(shfmt): add shell formatter
2020-12-04 14:08:01 +01:00
fix EXCEPTIONS management (#104) * FIX(1.1.21, 6.1.10) fix EXCEPTIONS management * Update changelog * Refactor test for 6.1.10-14
2021-06-02 13:47:19 +02:00
describe Running on blank host
register_test retvalshouldbe 0
register_test contain "No world writable files found"
# shellcheck disable=2154
Replace CIS_ROOT_DIR by a more flexible system (#204) * Replace CIS_ROOT_DIR by a more flexible system * Try to adapt the logic change to the functional tests
2023-09-25 14:24:01 +02:00
run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
IMP(test): Add feature to run functional tests in docker instance Add usecase in basename Add test files for checks with find command Always show logs FIX: run void script to generate config and avoid sed failure Update README with functional test description Add skeleton for functional test Add argument to launch only specific test suite Add support for debian8 and compulsory mention of debian version at launch Improve README Simplify test file syntax to avoid copy/paste mistake Add script that runs tests on all debian targets Improve run_all_target script with nowait and nodel options Add dockerfile for Buster pre-version Chore: Use getopt for options and reviewed code by shellcheck Add trap to ensure cleanup on exit/interrupt Remove quotes that lead to `less` misinterpretation of the filenames Set `local` for variables inside `test_audit` func Move functional assertion functions to dedicated file Add cleanup for logs and containers Improve cleanup, and now exits Apply shellcheck recommendations FIX: allow script to be run from anywhere (dirname $0) Changes to be committed: modified: README.md new file: src/skel.test new file: tests/docker/Dockerfile.debian10_20181226 new file: tests/docker/Dockerfile.debian8 new file: tests/docker/Dockerfile.debian9 new file: tests/docker_build_and_run_tests.sh new file: tests/hardening/12.10_find_suid_files.sh new file: tests/hardening/12.11_find_sgid_files.sh new file: tests/hardening/12.7_find_world_writable_file.sh new file: tests/hardening/12.8_find_unowned_files.sh new file: tests/hardening/12.9_find_ungrouped_files.sh new file: tests/hardening/2.17_sticky_bit_world_writable_folder.sh new file: tests/launch_tests.sh new file: tests/lib.sh new file: tests/run_all_targets.sh
2018-12-24 14:12:59 +01:00
fix EXCEPTIONS management (#104) * FIX(1.1.21, 6.1.10) fix EXCEPTIONS management * Update changelog * Refactor test for 6.1.10-14
2021-06-02 13:47:19 +02:00
describe Tests purposely failing
local targetfile="/home/secaudit/worldwritable"
touch "$targetfile"
chmod 777 "$targetfile"
register_test retvalshouldbe 1
register_test contain "Some world writable files are present"
Replace CIS_ROOT_DIR by a more flexible system (#204) * Replace CIS_ROOT_DIR by a more flexible system * Try to adapt the logic change to the functional tests
2023-09-25 14:24:01 +02:00
run noncompliant "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
IMP(test): Add feature to run functional tests in docker instance Add usecase in basename Add test files for checks with find command Always show logs FIX: run void script to generate config and avoid sed failure Update README with functional test description Add skeleton for functional test Add argument to launch only specific test suite Add support for debian8 and compulsory mention of debian version at launch Improve README Simplify test file syntax to avoid copy/paste mistake Add script that runs tests on all debian targets Improve run_all_target script with nowait and nodel options Add dockerfile for Buster pre-version Chore: Use getopt for options and reviewed code by shellcheck Add trap to ensure cleanup on exit/interrupt Remove quotes that lead to `less` misinterpretation of the filenames Set `local` for variables inside `test_audit` func Move functional assertion functions to dedicated file Add cleanup for logs and containers Improve cleanup, and now exits Apply shellcheck recommendations FIX: allow script to be run from anywhere (dirname $0) Changes to be committed: modified: README.md new file: src/skel.test new file: tests/docker/Dockerfile.debian10_20181226 new file: tests/docker/Dockerfile.debian8 new file: tests/docker/Dockerfile.debian9 new file: tests/docker_build_and_run_tests.sh new file: tests/hardening/12.10_find_suid_files.sh new file: tests/hardening/12.11_find_sgid_files.sh new file: tests/hardening/12.7_find_world_writable_file.sh new file: tests/hardening/12.8_find_unowned_files.sh new file: tests/hardening/12.9_find_ungrouped_files.sh new file: tests/hardening/2.17_sticky_bit_world_writable_folder.sh new file: tests/launch_tests.sh new file: tests/lib.sh new file: tests/run_all_targets.sh
2018-12-24 14:12:59 +01:00
feat: add FIND_IGNORE_NOSUCHFILE_ERR flag (#159) This flag can be used to prevent find-related checks to fail because one part of filesystem disappear (ie. ephemeral directories or files)
2022-07-04 14:29:25 +02:00
describe Tests failing with find ignore flag
Replace CIS_ROOT_DIR by a more flexible system (#204) * Replace CIS_ROOT_DIR by a more flexible system * Try to adapt the logic change to the functional tests
2023-09-25 14:24:01 +02:00
echo 'FIND_IGNORE_NOSUCHFILE_ERR=true' >>"${CIS_CONF_DIR}/conf.d/${script}.cfg"
feat: add FIND_IGNORE_NOSUCHFILE_ERR flag (#159) This flag can be used to prevent find-related checks to fail because one part of filesystem disappear (ie. ephemeral directories or files)
2022-07-04 14:29:25 +02:00
register_test retvalshouldbe 1
register_test contain "Some world writable files are present"
Replace CIS_ROOT_DIR by a more flexible system (#204) * Replace CIS_ROOT_DIR by a more flexible system * Try to adapt the logic change to the functional tests
2023-09-25 14:24:01 +02:00
run noncompliant "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
feat: add FIND_IGNORE_NOSUCHFILE_ERR flag (#159) This flag can be used to prevent find-related checks to fail because one part of filesystem disappear (ie. ephemeral directories or files)
2022-07-04 14:29:25 +02:00
fix EXCEPTIONS management (#104) * FIX(1.1.21, 6.1.10) fix EXCEPTIONS management * Update changelog * Refactor test for 6.1.10-14
2021-06-02 13:47:19 +02:00
describe correcting situation
Replace CIS_ROOT_DIR by a more flexible system (#204) * Replace CIS_ROOT_DIR by a more flexible system * Try to adapt the logic change to the functional tests
2023-09-25 14:24:01 +02:00
sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
fix EXCEPTIONS management (#104) * FIX(1.1.21, 6.1.10) fix EXCEPTIONS management * Update changelog * Refactor test for 6.1.10-14
2021-06-02 13:47:19 +02:00
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "No world writable files found"
Replace CIS_ROOT_DIR by a more flexible system (#204) * Replace CIS_ROOT_DIR by a more flexible system * Try to adapt the logic change to the functional tests
2023-09-25 14:24:01 +02:00
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
IMP(test): Add feature to run functional tests in docker instance Add usecase in basename Add test files for checks with find command Always show logs FIX: run void script to generate config and avoid sed failure Update README with functional test description Add skeleton for functional test Add argument to launch only specific test suite Add support for debian8 and compulsory mention of debian version at launch Improve README Simplify test file syntax to avoid copy/paste mistake Add script that runs tests on all debian targets Improve run_all_target script with nowait and nodel options Add dockerfile for Buster pre-version Chore: Use getopt for options and reviewed code by shellcheck Add trap to ensure cleanup on exit/interrupt Remove quotes that lead to `less` misinterpretation of the filenames Set `local` for variables inside `test_audit` func Move functional assertion functions to dedicated file Add cleanup for logs and containers Improve cleanup, and now exits Apply shellcheck recommendations FIX: allow script to be run from anywhere (dirname $0) Changes to be committed: modified: README.md new file: src/skel.test new file: tests/docker/Dockerfile.debian10_20181226 new file: tests/docker/Dockerfile.debian8 new file: tests/docker/Dockerfile.debian9 new file: tests/docker_build_and_run_tests.sh new file: tests/hardening/12.10_find_suid_files.sh new file: tests/hardening/12.11_find_sgid_files.sh new file: tests/hardening/12.7_find_world_writable_file.sh new file: tests/hardening/12.8_find_unowned_files.sh new file: tests/hardening/12.9_find_ungrouped_files.sh new file: tests/hardening/2.17_sticky_bit_world_writable_folder.sh new file: tests/launch_tests.sh new file: tests/lib.sh new file: tests/run_all_targets.sh
2018-12-24 14:12:59 +01:00
}
Reference in New Issue Copy Permalink