IMP(2.1x): Retrieve actual partition when symlink

Add function to retrieve actual partition from symlink in lib/utils.sh
Using this func in all 3 audit scripts

Improved tests to test this func

Apply shellcheck recommendations
Trim trailing spaces

bin/hardening/2.14_run_shm_nodev.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
 
+# run-shellcheck
 #
 # CIS Debian Hardening
 #
@@ -11,7 +12,9 @@
 set -e # One error, it's over
 set -u # One variable unset, it's over
 
+# shellcheck disable=2034
 HARDENING_LEVEL=2
+# shellcheck disable=2034
 DESCRIPTION="/run/shm with nodev option."
 
 # Quick factoring as many script use the same logic
@@ -21,6 +24,7 @@ OPTION="nodev"
 # This function will be called if the script status is on enabled / audit mode
 audit () {
     info "Verifying that $PARTITION is a partition"
+    get_partition_from_symlink "$PARTITION"
     FNRET=0
     is_a_partition "$PARTITION"
     if [ $FNRET -gt 0 ]; then
@@ -37,11 +41,11 @@ audit () {
             has_mounted_option $PARTITION $OPTION
             if [ $FNRET -gt 0 ]; then
                 warn "$PARTITION is not mounted with $OPTION at runtime"
-                FNRET=3 
+                FNRET=3
             else
                 ok "$PARTITION mounted with $OPTION"
             fi
-        fi       
+        fi
     fi
 }
 
@@ -59,7 +63,7 @@ apply () {
     elif [ $FNRET = 3 ]; then
         info "Remounting $PARTITION from fstab"
         remount_partition $PARTITION
-    fi 
+    fi
 }
 
 # This function will check config parameters required
@@ -79,8 +83,9 @@ if [ -z "$CIS_ROOT_DIR" ]; then
 fi
 
 # Main function, will call the proper functions given the configuration (audit, enabled, disabled)
-if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then
-    . $CIS_ROOT_DIR/lib/main.sh
+if [ -r "$CIS_ROOT_DIR"/lib/main.sh ]; then
+    # shellcheck source=/opt/debian-cis/lib/main.sh
+    . "$CIS_ROOT_DIR"/lib/main.sh
 else
     echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening"
     exit 128

bin/hardening/2.15_run_shm_nosuid.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
 
+# run-shellcheck
 #
 # CIS Debian Hardening
 #
@@ -11,7 +12,9 @@
 set -e # One error, it's over
 set -u # One variable unset, it's over
 
+# shellcheck disable=2034
 HARDENING_LEVEL=2
+# shellcheck disable=2034
 DESCRIPTION="/run/shm with nosuid option."
 
 # Quick factoring as many script use the same logic
@@ -21,6 +24,7 @@ OPTION="nosuid"
 # This function will be called if the script status is on enabled / audit mode
 audit () {
     info "Verifying that $PARTITION is a partition"
+    get_partition_from_symlink "$PARTITION"
     FNRET=0
     is_a_partition "$PARTITION"
     if [ $FNRET -gt 0 ]; then
@@ -37,11 +41,11 @@ audit () {
             has_mounted_option $PARTITION $OPTION
             if [ $FNRET -gt 0 ]; then
                 warn "$PARTITION is not mounted with $OPTION at runtime"
-                FNRET=3 
+                FNRET=3
             else
                 ok "$PARTITION mounted with $OPTION"
             fi
-        fi       
+        fi
     fi
 }
 
@@ -59,7 +63,7 @@ apply () {
     elif [ $FNRET = 3 ]; then
         info "Remounting $PARTITION from fstab"
         remount_partition $PARTITION
-    fi 
+    fi
 }
 
 # This function will check config parameters required
@@ -79,8 +83,9 @@ if [ -z "$CIS_ROOT_DIR" ]; then
 fi
 
 # Main function, will call the proper functions given the configuration (audit, enabled, disabled)
-if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then
-    . $CIS_ROOT_DIR/lib/main.sh
+if [ -r "$CIS_ROOT_DIR"/lib/main.sh ]; then
+    # shellcheck source=/opt/debian-cis/lib/main.sh
+    . "$CIS_ROOT_DIR"/lib/main.sh
 else
     echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening"
     exit 128

bin/hardening/2.16_run_shm_noexec.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
 
+# run-shellcheck
 #
 # CIS Debian Hardening
 #
@@ -11,7 +12,9 @@
 set -e # One error, it's over
 set -u # One variable unset, it's over
 
+# shellcheck disable=2034
 HARDENING_LEVEL=3
+# shellcheck disable=2034
 DESCRIPTION="/run/shm with noexec option."
 
 # Quick factoring as many script use the same logic
@@ -21,6 +24,7 @@ OPTION="noexec"
 # This function will be called if the script status is on enabled / audit mode
 audit () {
     info "Verifying that $PARTITION is a partition"
+    get_partition_from_symlink "$PARTITION"
     FNRET=0
     is_a_partition "$PARTITION"
     if [ $FNRET -gt 0 ]; then
@@ -37,11 +41,11 @@ audit () {
             has_mounted_option $PARTITION $OPTION
             if [ $FNRET -gt 0 ]; then
                 warn "$PARTITION is not mounted with $OPTION at runtime"
-                FNRET=3 
+                FNRET=3
             else
                 ok "$PARTITION mounted with $OPTION"
             fi
-        fi       
+        fi
     fi
 }
 
@@ -59,7 +63,7 @@ apply () {
     elif [ $FNRET = 3 ]; then
         info "Remounting $PARTITION from fstab"
         remount_partition $PARTITION
-    fi 
+    fi
 }
 
 # This function will check config parameters required
@@ -79,8 +83,9 @@ if [ -z "$CIS_ROOT_DIR" ]; then
 fi
 
 # Main function, will call the proper functions given the configuration (audit, enabled, disabled)
-if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then
-    . $CIS_ROOT_DIR/lib/main.sh
+if [ -r "$CIS_ROOT_DIR"/lib/main.sh ]; then
+    # shellcheck source=/opt/debian-cis/lib/main.sh
+    . "$CIS_ROOT_DIR"/lib/main.sh
 else
     echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening"
     exit 128

lib/utils.sh

@@ -258,9 +258,23 @@ is_kernel_option_enabled() {
 }
 
 #
-# Mounting point 
+# Mounting point
 #
 
+get_partition_from_symlink() {
+    local local_partition="$1"
+    if [ ! -e "$local_partition" ]; then
+        return
+    fi
+    filetype=$(stat -c %F "$local_partition")
+    if [ "$filetype" == "symbolic link" ]; then
+        actual_partition=$(readlink "$local_partition" )
+        warn "$local_partition actually is $actual_partition"
+        local_partition="$actual_partition"
+    fi
+    PARTITION="$local_partition"
+}
+
 # Verify $1 is a partition declared in fstab
 is_a_partition() {
 

tests/hardening/2.14_run_shm_nodev.sh

@@ -1,10 +1,17 @@
 # run-shellcheck
 test_audit() {
     describe Running on blank host
-    register_test retvalshouldbe 0
+    register_test retvalshouldbe 1
     dismiss_count_for_test
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
+    ln -s /dev/shm /run/shm
+
+    describe Partition symlink
+    register_test retvalshouldbe 1
+    register_test contain "[WARN] /run/shm actually is /dev/shm"
+    run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
     # TODO fill comprehensive tests
 }

tests/hardening/2.15_run_shm_nosuid.sh

@@ -6,5 +6,12 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
+    ln -s /dev/shm /run/shm
+
+    describe Partition symlink
+    register_test retvalshouldbe 1
+    register_test contain "[WARN] /run/shm actually is /dev/shm"
+    run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
     # TODO fill comprehensive tests
 }

tests/hardening/2.16_run_shm_noexec.sh

@@ -6,5 +6,12 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
+    ln -s /dev/shm /run/shm
+
+    describe Partition symlink
+    register_test retvalshouldbe 1
+    register_test contain "[WARN] /run/shm actually is /dev/shm"
+    run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
     # TODO fill comprehensive tests
 }