elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-22 13:37:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

fixup! IMP(4.5): rename to 1.6.1.2 improve test

Browse Source
This commit is contained in:
Thibault Ayanides 2020-11-17 12:56:10 +01:00
parent 84bff4ac88
commit d244a2e810
2 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
bin/hardening/1.6.2.1_enable_apparmor.sh
View File

@ -5,7 +5,7 @@
# #
# #
# 4.5 Activate AppArmor (Scored) # 1.6.2.1 Activate AppArmor (Scored)
# #
set -e # One error, it's over set -e # One error, it's over
@ -24,12 +24,19 @@ audit () {
else else
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
fi fi
ERROR=0
RESULT=$($SUDO_CMD grep "^\s*linux" /boot/grub/grub.cfg) RESULT=$($SUDO_CMD grep "^\s*linux" /boot/grub/grub.cfg)
for line in $RESULT; do for line in $RESULT; do
if [[ ! $line =~ "apparmor=1" ]] || [[ ! $line =~ "security=apparmor" ]]; then if [[ ! $line =~ "apparmor=1" ]] || [[ ! $line =~ "security=apparmor" ]]; then
crit "$line is not configured" crit "$line is not configured"
ERROR=1
fi fi
done done
if [ $ERROR = 0 ]; then
ok "$PACKAGE is configured"
fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
@ -40,6 +47,7 @@ apply () {
else else
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
fi fi
ERROR=0 ERROR=0
RESULT=$($SUDO_CMD grep "^\s*linux" /boot/grub/grub.cfg) RESULT=$($SUDO_CMD grep "^\s*linux" /boot/grub/grub.cfg)
for line in $RESULT; do for line in $RESULT; do
@ -49,9 +57,11 @@ apply () {
fi fi
done done
if [ $ERROR = 1 ]; then if [ $ERROR = 1 ]; then
$SUDO_CMD sed -i "s/GRUB_CMDLINE_LINUX=\"/GRUB_CMDLINE_LINUX=\"apparmor=1 security=apparmor\/" $SUDO_CMD sed -i "s/GRUB_CMDLINE_LINUX=\"/GRUB_CMDLINE_LINUX=\"apparmor=1 security=apparmor/" /etc/default/grub
$SUDO_CMD update-grub
else
ok "$PACKAGE is configured"
fi fi
$SUDO_CMD update-grub
} }
# This function will check config parameters required # This function will check config parameters required

9
tests/hardening/1.6.2.1_enable_apparmor.sh
View File

@ -9,6 +9,13 @@ test_audit() {
# shellcheck disable=2154 # shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "is configured"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
fi fi
} }