fix(6.2.9): Start from UID 1000 for home ownership check (#164)

Rename 6.2.3 and 6.2.9 checks to be more accurate Remove home existence check from 6.2.9 as it's handled by 6.2.3 Update tests accordingly Fixes #163 Signed-off-by: Tarik Megzari <tarik.megzari@corp.ovh.com> Signed-off-by: Tarik Megzari <tarik.megzari@corp.ovh.com>
2025-06-24 19:44:35 +02:00 · 2022-09-30 10:28:48 +02:00
parent e478a89bad
commit 82a217032d
4 changed files with 2 additions and 26 deletions
--- a/bin/hardening/6.2.9_users_homedir_ownership.sh
+++ b/bin/hardening/6.2.9_users_homedir_ownership.sh
@ -0,0 +1,84 @@
+#!/bin/bash
+
+# run-shellcheck
+#
+# CIS Debian Hardening
+#
+
+#
+# 6.2.9 Ensure users own their home directories (Scored)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# shellcheck disable=2034
+HARDENING_LEVEL=2
+# shellcheck disable=2034
+DESCRIPTION="Ensure users own their home directories"
+
+EXCEPTIONS=""
+
+ERRORS=0
+
+# This function will be called if the script status is on enabled / audit mode
+audit() {
+    RESULT=$(awk -F: '{ print $1 ":" $3 ":" $6 }' /etc/passwd)
+    for LINE in $RESULT; do
+        debug "Working on $LINE"
+        USER=$(awk -F: '{print $1}' <<<"$LINE")
+        USERID=$(awk -F: '{print $2}' <<<"$LINE")
+        DIR=$(awk -F: '{print $3}' <<<"$LINE")
+        if [ "$USERID" -ge 1000 ] && [ -d "$DIR" ] && [ "$USER" != "nfsnobody" ]; then
+            OWNER=$(stat -L -c "%U" "$DIR")
+            if [ "$OWNER" != "$USER" ]; then
+                EXCEP_FOUND=0
+                for excep in $EXCEPTIONS; do
+                    if [ "$DIR:$USER:$OWNER" = "$excep" ]; then
+                        ok "The home directory ($DIR) of user $USER is owned by $OWNER but is part of exceptions ($DIR:$USER:$OWNER)."
+                        EXCEP_FOUND=1
+                        break
+                    fi
+                done
+                if [ "$EXCEP_FOUND" -eq 0 ]; then
+                    crit "The home directory ($DIR) of user $USER is owned by $OWNER."
+                    ERRORS=$((ERRORS + 1))
+                fi
+            fi
+        fi
+    done
+
+    if [ "$ERRORS" = 0 ]; then
+        ok "All home directories have correct ownership"
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply() {
+    info "Modifying home directories may seriously harm your system, report only here"
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    # shellcheck source=../../debian/default
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_ROOT_DIR" ]; then
+    echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+    echo "Cannot source CIS_ROOT_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r "$CIS_ROOT_DIR"/lib/main.sh ]; then
+    # shellcheck source=../../lib/main.sh
+    . "$CIS_ROOT_DIR"/lib/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening"
+    exit 128
+fi