elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-22 13:37:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

FIX(99.2): add missing $SUDO_CMD

Browse Source
This commit is contained in:
Charles Herlin 2019-02-15 16:56:54 +01:00
parent 6ede832685
commit d18f5edfba
2 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
bin/hardening/99.2_disable_usb_devices.sh
View File

@ -23,9 +23,9 @@ audit () {
SEARCH_RES=0 SEARCH_RES=0
for FILE_SEARCHED in $FILES_TO_SEARCH; do for FILE_SEARCHED in $FILES_TO_SEARCH; do
if [ $SEARCH_RES = 1 ]; then break; fi if [ $SEARCH_RES = 1 ]; then break; fi
if test -d $FILE_SEARCHED; then if $SUDO_CMD test -d $FILE_SEARCHED; then
debug "$FILE_SEARCHED is a directory" debug "$FILE_SEARCHED is a directory"
for file_in_dir in $(ls $FILE_SEARCHED); do for file_in_dir in $( $SUDO_CMD ls $FILE_SEARCHED); do
does_pattern_exist_in_file "$FILE_SEARCHED/$file_in_dir" "^$PATTERN" does_pattern_exist_in_file "$FILE_SEARCHED/$file_in_dir" "^$PATTERN"
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
debug "$PATTERN is not present in $FILE_SEARCHED/$file_in_dir" debug "$PATTERN is not present in $FILE_SEARCHED/$file_in_dir"

20
tests/hardening/99.2_disable_usb_devices.sh Normal file
View File

@ -0,0 +1,20 @@
# run-shellcheck
test_audit() {
mkdir /etc/udev/rules.d
chmod -R 700 /etc/udev
describe Running on blank host
register_test retvalshouldbe 0
dismiss_count_for_test
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
echo 'ACTION=="add", SUBSYSTEMS=="usb", TEST=="authorized_default", ATTR{authorized_default}="0"' > /etc/udev/rules.d/10-CIS_99.2_usb_devices.sh
describe compliant
register_test retvalshouldbe 0
run compliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
}