elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-21 13:07:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add functions utils

Browse Source 
I added two functions in utils that checks perms and ownership for file
resulting for a certain find. It takes parameters to filter the results
if needed.
This commit is contained in:
Thibault Ayanides 2020-10-05 17:01:13 +02:00
parent d6e5803252
commit a37c5bdc4e
2 changed files with 33 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
bin/hardening/4.2.4_logs_permissions.sh
View File

@ -16,10 +16,12 @@ DESCRIPTION="Check permissions on logs (other has no permissions on any files an
DIR='/var/log'
PERMISSIONS='640'
OPTIONS=(-type f)
# This function will be called if the script status is on enabled / audit mode
audit () {
have_files_in_dir_correct_permissions $DIR $PERMISSIONS
have_files_in_dir_correct_permissions $DIR $PERMISSIONS OPTIONS
if [ $FNRET = 0 ]; then
ok "Logs in $DIR have correct permissions"
else
@ -29,9 +31,9 @@ audit () {
# This function will be called if the script status is on enabled mode
apply () {
have_files_in_dir_correct_permissions $DIR $PERMISSIONS
have_files_in_dir_correct_permissions $DIR $PERMISSIONS OPTIONS
if [ $FNRET = 0 ]; then
ok "$FILE has correct permissions"
ok "Logs in $DIR have correct permissions"
else
info "fixing $DIR logs permissions to $PERMISSIONS"
find $DIR -type f -exec chmod 0$PERMISSIONS {} \;

30
lib/utils.sh
View File

@ -84,6 +84,29 @@ has_file_correct_ownership() {
fi
}
have_files_in_dir_correct_ownership(){
local DIR=$1
local USER=$2
local GROUP=$3
local name=$4[@]
local OPTIONS=("${!name}")
local USERID=$(id -u $USER)
local GROUPID=$(getent group $GROUP | cut -d: -f3)
FNRET=0
OIFS="$IFS"
IFS=$'\n' # prevents word splitting
for owner in $("$SUDO_CMD find $DIR" "${OPTIONS[@]}" "-exec stat -c '%u %g' {} \;");
do
if [ "$owner" != "$USERID $GROUPID" ]; then
FNRET=1
break
fi
done
IFS="$OIFS"
}
has_file_correct_permissions() {
local FILE=$1
local PERMISSIONS=$2
@ -98,10 +121,13 @@ has_file_correct_permissions() {
have_files_in_dir_correct_permissions(){
local DIR=$1
local PERMISSIONS=$2
local name=$3[@]
local OPTIONS=("${!name}")
FNRET=0
for perm in $($SUDO_CMD find "$DIR" -type f -exec stat -L -c "%a" {} \;);
for perm in $("$SUDO_CMD find $DIR" "${OPTIONS[@]}" "-exec stat -L -c '%a' {} \;");
do
echo "$perm ttt $PERMISSIONS"
if [ "$perm" != "$PERMISSIONS" ]; then
FNRET=1
break