mirror of
https://github.com/ovh/debian-cis.git
synced 2025-06-23 02:54:35 +02:00
IMP(shfmt): add shell formatter
This commit is contained in:
Thibault Ayanides
95
lib/main.sh
95
lib/main.sh
@ -11,10 +11,10 @@ status=""
|
||||
forcedstatus=""
|
||||
SUDO_CMD=""
|
||||
|
||||
[ -r $CIS_ROOT_DIR/lib/constants.sh ] && . $CIS_ROOT_DIR/lib/constants.sh
|
||||
[ -r $CIS_ROOT_DIR/lib/constants.sh ] && . $CIS_ROOT_DIR/lib/constants.sh
|
||||
[ -r $CIS_ROOT_DIR/etc/hardening.cfg ] && . $CIS_ROOT_DIR/etc/hardening.cfg
|
||||
[ -r $CIS_ROOT_DIR/lib/common.sh ] && . $CIS_ROOT_DIR/lib/common.sh
|
||||
[ -r $CIS_ROOT_DIR/lib/utils.sh ] && . $CIS_ROOT_DIR/lib/utils.sh
|
||||
[ -r $CIS_ROOT_DIR/lib/common.sh ] && . $CIS_ROOT_DIR/lib/common.sh
|
||||
[ -r $CIS_ROOT_DIR/lib/utils.sh ] && . $CIS_ROOT_DIR/lib/utils.sh
|
||||
|
||||
# Environment Sanitizing
|
||||
export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
|
||||
@ -23,11 +23,11 @@ export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
|
||||
while [[ $# > 0 ]]; do
|
||||
ARG="$1"
|
||||
case $ARG in
|
||||
--audit-all)
|
||||
debug "Audit all specified, setting status to audit regardless of configuration"
|
||||
forcedstatus=auditall
|
||||
--audit-all)
|
||||
debug "Audit all specified, setting status to audit regardless of configuration"
|
||||
forcedstatus=auditall
|
||||
;;
|
||||
--audit)
|
||||
--audit)
|
||||
if [ "$status" != 'disabled' -a "$status" != 'false' ]; then
|
||||
debug "Audit argument detected, setting status to audit"
|
||||
forcedstatus=audit
|
||||
@ -35,21 +35,21 @@ while [[ $# > 0 ]]; do
|
||||
info "Audit argument passed but script is disabled"
|
||||
fi
|
||||
;;
|
||||
--create-config-files-only)
|
||||
debug "Create config files"
|
||||
forcedstatus=createconfig
|
||||
--create-config-files-only)
|
||||
debug "Create config files"
|
||||
forcedstatus=createconfig
|
||||
;;
|
||||
--sudo)
|
||||
--sudo)
|
||||
SUDO_CMD="sudo_wrapper"
|
||||
;;
|
||||
--batch)
|
||||
debug "Auditing in batch mode, will limit output by setting LOGLEVEL to 'ok'."
|
||||
BATCH_MODE=1
|
||||
LOGLEVEL=ok
|
||||
[ -r $CIS_ROOT_DIR/lib/common.sh ] && . $CIS_ROOT_DIR/lib/common.sh
|
||||
--batch)
|
||||
debug "Auditing in batch mode, will limit output by setting LOGLEVEL to 'ok'."
|
||||
BATCH_MODE=1
|
||||
LOGLEVEL=ok
|
||||
[ -r $CIS_ROOT_DIR/lib/common.sh ] && . $CIS_ROOT_DIR/lib/common.sh
|
||||
;;
|
||||
*)
|
||||
debug "Unknown option passed"
|
||||
*)
|
||||
debug "Unknown option passed"
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
@ -59,20 +59,20 @@ info "Working on $SCRIPT_NAME"
|
||||
info "[DESCRIPTION] $DESCRIPTION"
|
||||
|
||||
# Source specific configuration file
|
||||
if ! [ -r $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg ] ; then
|
||||
if ! [ -r $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg ]; then
|
||||
# If it doesn't exist, create it with default values
|
||||
echo "# Configuration for $SCRIPT_NAME, created from default values on `date`" > $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg
|
||||
echo "# Configuration for $SCRIPT_NAME, created from default values on $(date)" >$CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg
|
||||
# If create_config is a defined function, execute it.
|
||||
# Otherwise, just disable the test by default.
|
||||
if type -t create_config | grep -qw function ; then
|
||||
create_config >> $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg
|
||||
if type -t create_config | grep -qw function; then
|
||||
create_config >>$CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg
|
||||
else
|
||||
echo "status=audit" >> $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg
|
||||
echo "status=audit" >>$CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
if [ "$forcedstatus" = "createconfig" ] ; then
|
||||
if [ "$forcedstatus" = "createconfig" ]; then
|
||||
debug "$CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg has been created"
|
||||
exit 0
|
||||
fi
|
||||
@ -80,10 +80,10 @@ fi
|
||||
[ -r $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg ] && . $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg
|
||||
|
||||
# Now check configured value for status, and potential cmdline parameter
|
||||
if [ "$forcedstatus" = "auditall" ] ; then
|
||||
if [ "$forcedstatus" = "auditall" ]; then
|
||||
# We want to audit even disabled script, so override config value in any case
|
||||
status=audit
|
||||
elif [ "$forcedstatus" = "audit" ] ; then
|
||||
elif [ "$forcedstatus" = "audit" ]; then
|
||||
# We want to audit only enabled scripts
|
||||
if [ "$status" != 'disabled' -a "$status" != 'false' ]; then
|
||||
debug "Audit argument detected, setting status to audit"
|
||||
@ -99,29 +99,28 @@ if [ -z $status ]; then
|
||||
exit 2
|
||||
fi
|
||||
|
||||
|
||||
case $status in
|
||||
enabled | true )
|
||||
info "Checking Configuration"
|
||||
check_config
|
||||
info "Performing audit"
|
||||
audit # Perform audit
|
||||
info "Applying Hardening"
|
||||
apply # Perform hardening
|
||||
;;
|
||||
audit )
|
||||
info "Checking Configuration"
|
||||
check_config
|
||||
info "Performing audit"
|
||||
audit # Perform audit
|
||||
;;
|
||||
disabled | false )
|
||||
info "$SCRIPT_NAME is disabled, ignoring"
|
||||
exit 2 # Means unknown status
|
||||
;;
|
||||
*)
|
||||
warn "Wrong value for status : $status. Must be [ enabled | true | audit | disabled | false ]"
|
||||
;;
|
||||
enabled | true)
|
||||
info "Checking Configuration"
|
||||
check_config
|
||||
info "Performing audit"
|
||||
audit # Perform audit
|
||||
info "Applying Hardening"
|
||||
apply # Perform hardening
|
||||
;;
|
||||
audit)
|
||||
info "Checking Configuration"
|
||||
check_config
|
||||
info "Performing audit"
|
||||
audit # Perform audit
|
||||
;;
|
||||
disabled | false)
|
||||
info "$SCRIPT_NAME is disabled, ignoring"
|
||||
exit 2 # Means unknown status
|
||||
;;
|
||||
*)
|
||||
warn "Wrong value for status : $status. Must be [ enabled | true | audit | disabled | false ]"
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ $CRITICAL_ERRORS_NUMBER -eq 0 ]; then
|
||||
|
||||
Reference in New Issue
Block a user