elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-22 13:37:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

IMP(6.2.6): add purposely failing tests

Browse Source
This commit is contained in:
Thibault Ayanides 2020-10-27 09:17:57 +01:00
parent 1e64a14299
commit bb266ebe4a
2 changed files with 53 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
bin/hardening/6.2.6_sanitize_root_path.sh
View File

@ -8,6 +8,10 @@
# 6.2.6 Ensure root PATH Integrity (Scored) # 6.2.6 Ensure root PATH Integrity (Scored)
# #
# set path to the $PATH environnement variable if path is not defined
# used in test
[[ $path && ${path-x} ]] || path=$PATH
set -e # One error, it's over set -e # One error, it's over
set -u # One variable unset, it's over set -u # One variable unset, it's over
@ -18,15 +22,15 @@ ERRORS=0
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
if [ "`echo $PATH | grep :: `" != "" ]; then if [ "`echo $path | grep :: `" != "" ]; then
crit "Empty Directory in PATH (::)" crit "Empty Directory in PATH (::)"
ERRORS=$((ERRORS+1)) ERRORS=$((ERRORS+1))
fi fi
if [ "`echo $PATH | grep :$`" != "" ]; then if [ "`echo $path | grep :$`" != "" ]; then
crit "Trailing : in PATH $PATH" crit "Trailing : in PATH $path"
ERRORS=$((ERRORS+1)) ERRORS=$((ERRORS+1))
fi fi
FORMATTED_PATH=$(echo $PATH | sed -e 's/::/:/' -e 's/:$//' -e 's/:/ /g') FORMATTED_PATH=$(echo $path | sed -e 's/::/:/' -e 's/:$//' -e 's/:/ /g')
set -- $FORMATTED_PATH set -- $FORMATTED_PATH
while [ "${1:-}" != "" ]; do while [ "${1:-}" != "" ]; do
if [ "$1" = "." ]; then if [ "$1" = "." ]; then

46
tests/hardening/6.2.6_sanitize_root_path.sh
View File

@ -6,5 +6,49 @@ test_audit() {
# shellcheck disable=2154 # shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests local dir="/test"
local test_user="userrootpathtest"
describe Tests purposely failing
register_test retvalshouldbe 1
register_test contain "Empty Directory in PATH (::)"
run noncompliant path="$PATH::" /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe Tests purposely failing
register_test retvalshouldbe 1
register_test contain "Trailing : in PATH"
run noncompliant path="$PATH:" /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe Tests purposely failing
register_test retvalshouldbe 1
register_test contain "PATH contains ."
run noncompliant path="$PATH:." /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe Tests purposely failing
mkdir -m 770 $dir
register_test retvalshouldbe 1
register_test contain "Group Write permission set on directory $dir"
run noncompliant path="$PATH:$dir" /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# clean
rmdir $dir
describe Tests purposely failing
mkdir -m 707 $dir
register_test retvalshouldbe 1
register_test contain "Other Write permission set on directory $dir"
run noncompliant path="$PATH:$dir" /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# clean
rmdir $dir
describe Tests purposely failing
useradd $test_user
mkdir -m 700 $dir
chown userrootpathtest:userrootpathtest $dir
register_test retvalshouldbe 1
register_test contain "$dir is not owned by root"
run noncompliant path="$PATH:$dir" /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# clean
rmdir $dir
userdel $test_user
} }