mirror of
https://github.com/ovh/debian-cis.git
synced 2025-06-22 02:33:42 +02:00
IMP: add multiple Improvements
* add new kernel module detection (enable & listing) with detection of monolithic kernel * change way to detect if file system type is disabled * add global IS_CONTAINER variable * disable test for 3.4.x to be consistent with others * add cli options to override configuration loglevel
This commit is contained in:
@ -26,6 +26,7 @@ ALLOW_SERVICE_LIST=0
|
||||
SET_HARDENING_LEVEL=0
|
||||
SUDO_MODE=''
|
||||
BATCH_MODE=''
|
||||
ASK_LOGLEVEL=''
|
||||
|
||||
usage() {
|
||||
cat <<EOF
|
||||
@ -98,6 +99,10 @@ OPTIONS:
|
||||
the '-n' option instructs sudo not to prompt for a password.
|
||||
Finally note that '--sudo' mode only works for audit mode.
|
||||
|
||||
--set-log-level <level>
|
||||
This option sets LOGLEVEL, you can choose : info, warning, error, ok, debug.
|
||||
Default value is : info
|
||||
|
||||
--batch
|
||||
While performing system audit, this option sets LOGLEVEL to 'ok' and
|
||||
captures all output to print only one line once the check is done, formatted like :
|
||||
@ -143,6 +148,10 @@ while [[ $# -gt 0 ]]; do
|
||||
SET_HARDENING_LEVEL="$2"
|
||||
shift
|
||||
;;
|
||||
--set-log-level)
|
||||
ASK_LOGLEVEL=$2
|
||||
shift
|
||||
;;
|
||||
--only)
|
||||
TEST_LIST[${#TEST_LIST[@]}]="$2"
|
||||
shift
|
||||
@ -152,7 +161,7 @@ while [[ $# -gt 0 ]]; do
|
||||
;;
|
||||
--batch)
|
||||
BATCH_MODE='--batch'
|
||||
LOGLEVEL=ok
|
||||
ASK_LOGLEVEL=ok
|
||||
;;
|
||||
-h | --help)
|
||||
usage
|
||||
@ -183,13 +192,12 @@ fi
|
||||
[ -r "$CIS_ROOT_DIR"/lib/constants.sh ] && . "$CIS_ROOT_DIR"/lib/constants.sh
|
||||
# shellcheck source=../etc/hardening.cfg
|
||||
[ -r "$CIS_ROOT_DIR"/etc/hardening.cfg ] && . "$CIS_ROOT_DIR"/etc/hardening.cfg
|
||||
if [ "$ASK_LOGLEVEL" ]; then LOGLEVEL=$ASK_LOGLEVEL; fi
|
||||
# shellcheck source=../lib/common.sh
|
||||
[ -r "$CIS_ROOT_DIR"/lib/common.sh ] && . "$CIS_ROOT_DIR"/lib/common.sh
|
||||
# shellcheck source=../lib/utils.sh
|
||||
[ -r "$CIS_ROOT_DIR"/lib/utils.sh ] && . "$CIS_ROOT_DIR"/lib/utils.sh
|
||||
|
||||
if [ "$BATCH_MODE" ]; then MACHINE_LOG_LEVEL=3; fi
|
||||
|
||||
# If --allow-service-list is specified, don't run anything, just list the supported services
|
||||
if [ "$ALLOW_SERVICE_LIST" = 1 ]; then
|
||||
declare -a HARDENING_EXCEPTIONS_LIST
|
||||
|
@ -17,28 +17,36 @@ HARDENING_LEVEL=2
|
||||
# shellcheck disable=2034
|
||||
DESCRIPTION="Disable mounting of freevxfs filesystems."
|
||||
|
||||
# Note: we check /proc/config.gz to be compliant with both monolithic and modular kernels
|
||||
|
||||
KERNEL_OPTION="CONFIG_VXFS_FS"
|
||||
MODULE_NAME="freevxfs"
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$KERNEL_OPTION is enabled!"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing or disable this check!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$MODULE_NAME is enabled!"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $KERNEL_OPTION enabled, recompile your kernel please"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled, nothing to do"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
|
@ -17,28 +17,36 @@ HARDENING_LEVEL=2
|
||||
# shellcheck disable=2034
|
||||
DESCRIPTION="Disable mounting of jffs2 filesystems."
|
||||
|
||||
# Note: we check /proc/config.gz to be compliant with both monolithic and modular kernels
|
||||
|
||||
KERNEL_OPTION="CONFIG_JFFS2_FS"
|
||||
MODULE_NAME="jffs2"
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$KERNEL_OPTION is enabled!"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing or disable this check!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$MODULE_NAME is enabled!"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $KERNEL_OPTION enabled, recompile your kernel please"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled, nothing to do"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
|
@ -17,28 +17,36 @@ HARDENING_LEVEL=2
|
||||
# shellcheck disable=2034
|
||||
DESCRIPTION="Disable mounting of hfs filesystems."
|
||||
|
||||
# Note: we check /proc/config.gz to be compliant with both monolithic and modular kernels
|
||||
|
||||
KERNEL_OPTION="CONFIG_HFS_FS"
|
||||
MODULE_FILE="hfs"
|
||||
MODULE_NAME="hfs"
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_FILE"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$KERNEL_OPTION is enabled!"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing or disable this check!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$MODULE_NAME is enabled!"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $KERNEL_OPTION enabled, recompile your kernel please"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled, nothing to do"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
|
@ -17,28 +17,36 @@ HARDENING_LEVEL=2
|
||||
# shellcheck disable=2034
|
||||
DESCRIPTION="Disable mounting of hfsplus filesystems."
|
||||
|
||||
# Note: we check /proc/config.gz to be compliant with both monolithic and modular kernels
|
||||
|
||||
KERNEL_OPTION="CONFIG_HFSPLUS_FS"
|
||||
MODULE_FILE="hfsplus"
|
||||
MODULE_NAME="hfsplus"
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_FILE"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$KERNEL_OPTION is enabled!"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing or disable this check!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$MODULE_NAME is enabled!"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $KERNEL_OPTION enabled, recompile your kernel please"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled, nothing to do"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
|
@ -17,31 +17,37 @@ HARDENING_LEVEL=2
|
||||
# shellcheck disable=2034
|
||||
DESCRIPTION="Disable mounting of squashfs filesytems."
|
||||
|
||||
# Note: we check /proc/config.gz to be compliant with both monolithic and modular kernels
|
||||
|
||||
KERNEL_OPTION="CONFIG_SQUASHFS"
|
||||
MODULE_FILE="squashfs"
|
||||
MODULE_NAME="squashfs"
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_FILE"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$KERNEL_OPTION is enabled!"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing or disable this check!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$MODULE_NAME is enabled!"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
:
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $KERNEL_OPTION enabled, recompile your kernel please"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled, nothing to do"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
:
|
||||
}
|
||||
|
||||
# This function will check config parameters required
|
||||
|
@ -17,28 +17,36 @@ HARDENING_LEVEL=2
|
||||
# shellcheck disable=2034
|
||||
DESCRIPTION="Disable mounting of udf filesystems."
|
||||
|
||||
# Note: we check /proc/config.gz to be compliant with both monolithic and modular kernels
|
||||
|
||||
KERNEL_OPTION="CONFIG_UDF_FS"
|
||||
MODULE_FILE="udf"
|
||||
MODULE_NAME="udf"
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_FILE"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$KERNEL_OPTION is enabled!"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing or disable this check!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$MODULE_NAME is enabled!"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $KERNEL_OPTION enabled, recompile your kernel please"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled, nothing to do"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
|
@ -24,6 +24,7 @@ MODULE_FILE="vfat"
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
# TODO check if uefi enabled if yes check if only boot partition use FAT
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_FILE"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$KERNEL_OPTION is enabled!"
|
||||
|
@ -20,25 +20,35 @@ DESCRIPTION="Disable USB storage."
|
||||
# Note: we check /proc/config.gz to be compliant with both monolithic and modular kernels
|
||||
|
||||
KERNEL_OPTION="CONFIG_USB_STORAGE"
|
||||
MODULE_FILE="usb-storage"
|
||||
MODULE_NAME="usb-storage"
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_FILE"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$KERNEL_OPTION is enabled!"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing or disable this check!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$MODULE_NAME is enabled!"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $KERNEL_OPTION enabled, recompile your kernel please"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled, nothing to do"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
|
@ -24,21 +24,31 @@ MODULE_NAME="dccp"
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$KERNEL_OPTION is enabled!"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing or disable this check!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$MODULE_NAME is enabled!"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $KERNEL_OPTION enabled, recompile your kernel please"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled, nothing to do"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
|
@ -24,21 +24,31 @@ MODULE_NAME="sctp"
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$KERNEL_OPTION is enabled!"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing or disable this check!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$MODULE_NAME is enabled!"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $KERNEL_OPTION enabled, recompile your kernel please"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled, nothing to do"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
|
@ -24,21 +24,31 @@ MODULE_NAME="rds"
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$KERNEL_OPTION is enabled!"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing or disable this check!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$MODULE_NAME is enabled!"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $KERNEL_OPTION enabled, recompile your kernel please"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled, nothing to do"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
|
@ -24,21 +24,31 @@ MODULE_NAME="tipc"
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$KERNEL_OPTION is enabled!"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing or disable this check!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$MODULE_NAME is enabled!"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $KERNEL_OPTION enabled, recompile your kernel please"
|
||||
if [ "$IS_CONTAINER" -eq 1 ]; then
|
||||
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
|
||||
ok "Container detected, consider host enforcing!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled, nothing to do"
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
|
||||
else
|
||||
ok "$MODULE_NAME is disabled"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
|
Reference in New Issue
Block a user