From 1bacb6c2ff1070874672d99111a3604c59f2b67f Mon Sep 17 00:00:00 2001
From: "thibault.dewailly" <thibault.dewailly@ovh.net>
Date: Mon, 11 Apr 2016 14:55:42 +0200
Subject: [PATCH] 4.1_restrict_core_dumps.sh

---
 bin/hardening/4.1_restrict_core_dumps.sh | 75 ++++++++++++++++++++++++
 etc/conf.d/4.1_restrict_core_dumps.cfg   |  2 +
 lib/utils.sh                             | 45 ++++++++++++++
 3 files changed, 122 insertions(+)
 create mode 100755 bin/hardening/4.1_restrict_core_dumps.sh
 create mode 100644 etc/conf.d/4.1_restrict_core_dumps.cfg

diff --git a/bin/hardening/4.1_restrict_core_dumps.sh b/bin/hardening/4.1_restrict_core_dumps.sh
new file mode 100755
index 0000000..66fd715
--- /dev/null
+++ b/bin/hardening/4.1_restrict_core_dumps.sh
@@ -0,0 +1,75 @@
+#!/bin/bash
+
+#
+# CIS Debian 7 Hardening
+#
+
+#
+# Hardening script skeleton replace this line with proper point treated
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+LIMIT_FILE='/etc/security/limits.conf'
+LIMIT_PATTERN='^\*[[:space:]]*hard[[:space:]]*core[[:space:]]*0$'
+SYSCTL_PARAM='fs.suid_dumpable'
+SYSCTL_EXP_RESULT=0
+
+# This function will be called if the script status is on enabled / audit mode
+audit () {
+    does_pattern_exists_in_file $LIMIT_FILE $LIMIT_PATTERN
+    if [ $FNRET != 0 ]; then
+        crit "$LIMIT_PATTERN not present in $LIMIT_FILE"
+    else
+        ok "$LIMIT_PATTERN present in $LIMIT_FILE"
+    fi
+    has_sysctl_param_expected_result "$SYSCTL_PARAM" "$SYSCTL_EXP_RESULT"
+    if [ $FNRET != 0 ]; then
+        crit "$SYSCTL_PARAM has not $SYSCTL_EXP_RESULT value !"
+    elif [ $FNRET = 255 ]; then
+        warn "$SYSCTL_PARAM does not exist, typo ?"
+    else
+        ok "$SYSCTL_PARAM correctly set to $SYSCTL_EXP_RESULT"
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply () {
+    does_pattern_exists_in_file $LIMIT_FILE $LIMIT_PATTERN
+    if [ $FNRET != 0 ]; then
+        warn "$LIMIT_PATTERN not present in $LIMIT_FILE, addning at the end of  $LIMIT_FILE"
+        add_end_of_file $LIMIT_FILE "* hard core 0"
+    else
+        ok "$LIMIT_PATTERN present in $LIMIT_FILE"
+    fi
+    has_sysctl_param_expected_result "$SYSCTL_PARAM" "$SYSCTL_EXP_RESULT"
+    if [ $FNRET != 0 ]; then
+        warn "$SYSCTL_PARAM has not $SYSCTL_EXP_RESULT value, correcting it"
+        set_sysctl_param $SYSCTL_PARAM $SYSCTL_EXP_RESULT
+    elif [ $FNRET = 255 ]; then
+        warn "$SYSCTL_PARAM does not exist, typo ?"
+    else
+        ok "$SYSCTL_PARAM correctly set to $SYSCTL_EXP_RESULT"
+    fi 
+
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ ! -r /etc/default/cis-hardenning ]; then
+    echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
+    exit 128
+else
+    . /etc/default/cis-hardenning
+    if [ -z $CIS_ROOT_DIR ]; then
+        echo "No CIS_ROOT_DIR variable, aborting"
+    fi
+fi 
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh
diff --git a/etc/conf.d/4.1_restrict_core_dumps.cfg b/etc/conf.d/4.1_restrict_core_dumps.cfg
new file mode 100644
index 0000000..acee522
--- /dev/null
+++ b/etc/conf.d/4.1_restrict_core_dumps.cfg
@@ -0,0 +1,2 @@
+# Configuration for script of same name
+status=disabled
diff --git a/lib/utils.sh b/lib/utils.sh
index ff38696..6fafe73 100644
--- a/lib/utils.sh
+++ b/lib/utils.sh
@@ -1,5 +1,40 @@
 # CIS Debian 7 Hardening Utility functions
 
+#
+# Sysctl Manipulation
+#
+
+has_sysctl_param_expected_result() {
+    local SYSCTL_PARAM=$1
+    local EXP_RESULT=$2
+
+    if [ "$(sysctl $SYSCTL_PARAM 2>/dev/null)" = "$SYSCTL_PARAM = $EXP_RESULT" ]; then
+        FNRET=0
+    elif [ $? != 0 ]; then
+        debug "$SYSCTL_PARAM does not exist"
+        FNRET=255
+    else
+        debug "$SYSCTL_PARAM has not a value of $EXP_RESULT"
+        FNRET=1
+    fi
+}
+
+set_sysctl_param() {
+    local SYSCTL_PARAM=$1
+    local VALUE=$2
+    debug "Setting $SYSCTL_PARAM to $VALUE"
+    if [ "$(sysctl -w $SYSCTL_PARAM 2>/dev/null)" = "$SYSCTL_PARAM = $VALUE" ]; then
+        FNRET=0
+    elif [ $? != 0 ]; then
+        debug "$SYSCTL_PARAM does not exist"
+        FNRET=255
+    else
+        warn "$SYSCTL_PARAM Failed !"
+        FNRET=1
+    fi
+}
+
+
 #
 # File manipulation
 #
@@ -51,6 +86,16 @@ does_pattern_exists_in_file() {
 
 }
 
+add_end_of_file() {
+    local FILE=$1
+    local LINE=$2
+
+    debug "Adding $LINE at the end of $FILE"
+    backup_file "$1"
+    echo "$2" >> $FILE
+}
+    
+
 #
 # User manipulation
 #