mirror of
https://github.com/ovh/debian-cis.git
synced 2025-06-22 02:33:42 +02:00
feat: add FIND_IGNORE_NOSUCHFILE_ERR flag (#159)
This flag can be used to prevent find-related checks to fail because one part of filesystem disappear (ie. ephemeral directories or files)
This commit is contained in:
@ -19,6 +19,10 @@ DESCRIPTION="Set sticky bit on world writable directories to prevent users from
|
||||
|
||||
EXCEPTIONS=''
|
||||
|
||||
# find emits following error if directory or file disappear during
|
||||
# tree traversal: find: ‘/tmp/xxx’: No such file or directory
|
||||
FIND_IGNORE_NOSUCHFILE_ERR=false
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
info "Checking if setuid is set on world writable Directories"
|
||||
@ -26,13 +30,17 @@ audit() {
|
||||
# maybe EXCEPTIONS allow us to filter out some FS
|
||||
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}' | grep -vE "$EXCEPTIONS")
|
||||
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
|
||||
# shellcheck disable=SC2086
|
||||
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -type d \( -perm -0002 -a ! -perm -1000 \) -regextype 'egrep' ! -regex $EXCEPTIONS -print 2>/dev/null)
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
|
||||
else
|
||||
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}')
|
||||
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
|
||||
# shellcheck disable=SC2086
|
||||
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null)
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
|
||||
fi
|
||||
|
||||
if [ -n "$RESULT" ]; then
|
||||
|
@ -19,6 +19,10 @@ DESCRIPTION="Ensure no world writable files exist"
|
||||
|
||||
EXCLUDED=''
|
||||
|
||||
# find emits following error if directory or file disappear during
|
||||
# tree traversal: find: ‘/tmp/xxx’: No such file or directory
|
||||
FIND_IGNORE_NOSUCHFILE_ERR=false
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
info "Checking if there are world writable files"
|
||||
@ -26,13 +30,17 @@ audit() {
|
||||
# maybe EXCLUDED allow us to filter out some FS
|
||||
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}' | grep -vE "$EXCLUDED")
|
||||
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
|
||||
# shellcheck disable=SC2086
|
||||
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -type f -perm -0002 -regextype 'egrep' ! -regex $EXCLUDED -print 2>/dev/null)
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
|
||||
else
|
||||
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}')
|
||||
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
|
||||
# shellcheck disable=SC2086
|
||||
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -type f -perm -0002 -print 2>/dev/null)
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
|
||||
fi
|
||||
|
||||
if [ -n "$RESULT" ]; then
|
||||
|
@ -20,6 +20,10 @@ DESCRIPTION="Ensure no unowned files or directories exist."
|
||||
USER='root'
|
||||
EXCLUDED=''
|
||||
|
||||
# find emits following error if directory or file disappear during
|
||||
# tree traversal: find: ‘/tmp/xxx’: No such file or directory
|
||||
FIND_IGNORE_NOSUCHFILE_ERR=false
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
info "Checking if there are unowned files"
|
||||
@ -27,13 +31,17 @@ audit() {
|
||||
# maybe EXCLUDED allow us to filter out some FS
|
||||
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}' | grep -vE "$EXCLUDED")
|
||||
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
|
||||
# shellcheck disable=SC2086
|
||||
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -nouser -regextype 'egrep' ! -regex $EXCLUDED -print 2>/dev/null)
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
|
||||
else
|
||||
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}')
|
||||
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
|
||||
# shellcheck disable=SC2086
|
||||
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -nouser -print 2>/dev/null)
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
|
||||
fi
|
||||
|
||||
if [ -n "$RESULT" ]; then
|
||||
|
@ -20,6 +20,10 @@ DESCRIPTION="Ensure no ungrouped files or directories exist"
|
||||
GROUP='root'
|
||||
EXCLUDED=''
|
||||
|
||||
# find emits following error if directory or file disappear during
|
||||
# tree traversal: find: ‘/tmp/xxx’: No such file or directory
|
||||
FIND_IGNORE_NOSUCHFILE_ERR=false
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
info "Checking if there are ungrouped files"
|
||||
@ -27,13 +31,18 @@ audit() {
|
||||
# maybe EXCLUDED allow us to filter out some FS
|
||||
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}' | grep -vE "$EXCLUDED")
|
||||
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
|
||||
# shellcheck disable=SC2086
|
||||
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -nogroup -regextype 'egrep' ! -regex $EXCLUDED -print 2>/dev/null)
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
|
||||
|
||||
else
|
||||
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}')
|
||||
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
|
||||
# shellcheck disable=SC2086
|
||||
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -nogroup -print 2>/dev/null)
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
|
||||
fi
|
||||
|
||||
if [ -n "$RESULT" ]; then
|
||||
|
@ -18,6 +18,10 @@ HARDENING_LEVEL=2
|
||||
DESCRIPTION="Find SUID system executables."
|
||||
IGNORED_PATH=''
|
||||
|
||||
# find emits following error if directory or file disappear during
|
||||
# tree traversal: find: ‘/tmp/xxx’: No such file or directory
|
||||
FIND_IGNORE_NOSUCHFILE_ERR=false
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
info "Checking if there are suid files"
|
||||
@ -25,13 +29,17 @@ audit() {
|
||||
# maybe IGNORED_PATH allow us to filter out some FS
|
||||
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}' | grep -vE "$IGNORED_PATH")
|
||||
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
|
||||
# shellcheck disable=2086
|
||||
FOUND_BINARIES=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -type f -perm -4000 -regextype 'egrep' ! -regex $IGNORED_PATH -print)
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
|
||||
else
|
||||
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}')
|
||||
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
|
||||
# shellcheck disable=2086
|
||||
FOUND_BINARIES=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -type f -perm -4000 -print)
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
|
||||
fi
|
||||
|
||||
BAD_BINARIES=""
|
||||
|
@ -18,6 +18,10 @@ HARDENING_LEVEL=2
|
||||
DESCRIPTION="Find SGID system executables."
|
||||
IGNORED_PATH=''
|
||||
|
||||
# find emits following error if directory or file disappear during
|
||||
# tree traversal: find: ‘/tmp/xxx’: No such file or directory
|
||||
FIND_IGNORE_NOSUCHFILE_ERR=false
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
info "Checking if there are sgid files"
|
||||
@ -25,13 +29,18 @@ audit() {
|
||||
# maybe IGNORED_PATH allow us to filter out some FS
|
||||
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}' | grep -vE "$IGNORED_PATH")
|
||||
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
|
||||
# shellcheck disable=2086
|
||||
FOUND_BINARIES=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -type f -perm -2000 -regextype 'egrep' ! -regex $IGNORED_PATH -print)
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
|
||||
|
||||
else
|
||||
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}')
|
||||
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
|
||||
# shellcheck disable=2086
|
||||
FOUND_BINARIES=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -type f -perm -2000 -print)
|
||||
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
|
||||
fi
|
||||
|
||||
BAD_BINARIES=""
|
||||
|
Reference in New Issue
Block a user