elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2025-06-22 02:33:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixup! IMP(4.5): rename to 1.6.1.2 improve test

Browse Source
This commit is contained in:
Thibault Ayanides
2020-11-17 12:56:10 +01:00
parent 84bff4ac88
commit d244a2e810
2 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
bin/hardening/1.6.2.1_enable_apparmor.sh
View File

@ -5,7 +5,7 @@
#
#
# 4.5 Activate AppArmor (Scored)
# 1.6.2.1 Activate AppArmor (Scored)
#
set -e # One error, it's over
@ -24,12 +24,19 @@ audit () {
else
ok "$PACKAGE is installed"
fi
ERROR=0
RESULT=$($SUDO_CMD grep "^\s*linux" /boot/grub/grub.cfg)
for line in $RESULT; do
if [[ ! $line =~ "apparmor=1" ]] || [[ ! $line =~ "security=apparmor" ]]; then
crit "$line is not configured"
ERROR=1
fi
done
if [ $ERROR = 0 ]; then
ok "$PACKAGE is configured"
fi
}
# This function will be called if the script status is on enabled mode
@ -40,6 +47,7 @@ apply () {
else
ok "$PACKAGE is installed"
fi
ERROR=0
RESULT=$($SUDO_CMD grep "^\s*linux" /boot/grub/grub.cfg)
for line in $RESULT; do
@ -49,9 +57,11 @@ apply () {
fi
done
if [ $ERROR = 1 ]; then
$SUDO_CMD sed -i "s/GRUB_CMDLINE_LINUX=\"/GRUB_CMDLINE_LINUX=\"apparmor=1 security=apparmor\/"
$SUDO_CMD sed -i "s/GRUB_CMDLINE_LINUX=\"/GRUB_CMDLINE_LINUX=\"apparmor=1 security=apparmor/" /etc/default/grub
$SUDO_CMD update-grub
else
ok "$PACKAGE is configured"
fi
$SUDO_CMD update-grub
}
# This function will check config parameters required