Damcava35/update lib (#277)

* update lib/utils.sh

- add 'is_pkg_a_dependency', to ensure a package is not needed by some others before removing it
-> will be used in debian 12 CIS by at least the 2.1.5 recommendation

- update 'is_service_enabled' to use 'systemd' instead of 'rc.d', as we are now only supporting debian LTS using systemd
- add 'is_using_sbin_init' to ensure we can use systemctl, in case of running on non detected container
- add 'manage_service' to enable / disable service using systemctl

* chore: update script related to systemctl / service

- configure_systemd-timesync.sh:        use "is_service_enabled" instead of calling systemctl
- disable_automounting.sh:              use "manage_service" instead of "update-rc.d"
- enable_auditd.sh:                     use "manage_service" instead of "update-rc.d"
- enable_cron.sh:                       use "manage_service" instead of "update-rc.d"
- enable_syslog-ng.sh:                  use "manage_service" instead of "update-rc.d"

---------

Co-authored-by: Damien Cavagnini <damien.cavagnini@corp.ovh.com>

bin/hardening/configure_systemd-timesyncd.sh

@@ -21,8 +21,8 @@ SERVICE_NAME="systemd-timesyncd"
 
 # This function will be called if the script status is on enabled / audit mode
 audit() {
-    status=$(systemctl is-enabled "$SERVICE_NAME")
-    if [ "$status" = "enabled" ]; then
+    is_service_enabled "$SERVICE_NAME"
+    if [ "$FNRET" -eq 0 ]; then
         ok "$SERVICE_NAME is enabled"
     else
         crit "$SERVICE_NAME is disabled"

bin/hardening/disable_automounting.sh

@@ -36,7 +36,7 @@ apply() {
     is_service_enabled "$SERVICE_NAME"
     if [ "$FNRET" = 0 ]; then
         info "Disabling $SERVICE_NAME"
-        update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1
+        manage_service disable "$SERVICE_NAME"
     else
         ok "$SERVICE_NAME is disabled"
     fi

bin/hardening/enable_auditd.sh

@@ -50,8 +50,7 @@ apply() {
         ok "$SERVICE_NAME is enabled"
     else
         warn "$SERVICE_NAME is not enabled, enabling it"
-        update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1
-        update-rc.d "$SERVICE_NAME" defaults >/dev/null 2>&1
+        manage_service enable "$SERVICE_NAME"
     fi
 }
 

bin/hardening/enable_cron.sh

@@ -47,8 +47,7 @@ apply() {
         is_service_enabled "$SERVICE_NAME"
         if [ "$FNRET" != 0 ]; then
             info "Enabling $SERVICE_NAME"
-            update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1
-            update-rc.d "$SERVICE_NAME" defaults >/dev/null 2>&1
+            manage_service enable "$SERVICE_NAME"
         else
             ok "$SERVICE_NAME is enabled"
         fi

bin/hardening/enable_syslog-ng.sh

@@ -46,8 +46,7 @@ apply() {
         is_service_enabled "$SERVICE_NAME"
         if [ "$FNRET" != 0 ]; then
             info "Enabling $SERVICE_NAME"
-            update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1
-            update-rc.d "$SERVICE_NAME" defaults >/dev/null 2>&1
+            manage_service enable "$SERVICE_NAME" >/dev/null 2>&1
         else
             ok "$SERVICE_NAME is enabled"
         fi