diff --git a/tests/hardening/find_ungrouped_files.sh b/tests/hardening/find_ungrouped_files.sh index 6747c45..7bb1d73 100644 --- a/tests/hardening/find_ungrouped_files.sh +++ b/tests/hardening/find_ungrouped_files.sh @@ -4,8 +4,9 @@ test_audit() { describe Running void to generate the conf file that will later be edited # shellcheck disable=2154 "${CIS_CHECKS_DIR}/${script}.sh" || true + sed -i '/^EXCLUDED/d' "${CIS_CONF_DIR}/conf.d/${script}.cfg" # shellcheck disable=2016 - echo 'EXCLUDED="$EXCLUDED ^/home/secaudit/6.1.12/.*"' >>"${CIS_CONF_DIR}/conf.d/${script}.cfg" + echo 'EXCLUDED="^/proc|^/home/secaudit/6.1.12/.*"' >>"${CIS_CONF_DIR}/conf.d/${script}.cfg" mkdir /home/secaudit/6.1.12/ touch /home/secaudit/6.1.12/test chown 1200:1200 /home/secaudit/6.1.12/test @@ -25,17 +26,20 @@ test_audit() { run noncompliant "${CIS_CHECKS_DIR}/${script}.sh" --audit-all describe Tests failing with find ignore flag + sed -i '/^FIND_IGNORE_NOSUCHFILE_ERR/d' "${CIS_CONF_DIR}/conf.d/${script}.cfg" echo 'FIND_IGNORE_NOSUCHFILE_ERR=true' >>"${CIS_CONF_DIR}/conf.d/${script}.cfg" register_test retvalshouldbe 1 register_test contain "Some ungrouped files are present" run noncompliant "${CIS_CHECKS_DIR}/${script}.sh" --audit-all describe correcting situation - sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg" + sed -i '/^status/s/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg" "${CIS_CHECKS_DIR}/${script}.sh" --apply || true describe Checking resolved state register_test retvalshouldbe 0 register_test contain "No ungrouped files found" run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all + + rm -rf /home/secaudit/6.1.12/ /home/secaudit/ungrouped } diff --git a/tests/hardening/find_unowned_files.sh b/tests/hardening/find_unowned_files.sh index 5480388..a925735 100644 --- a/tests/hardening/find_unowned_files.sh +++ b/tests/hardening/find_unowned_files.sh @@ -4,8 +4,9 @@ test_audit() { describe Running void to generate the conf file that will later be edited # shellcheck disable=2154 "${CIS_CHECKS_DIR}/${script}.sh" || true + sed -i '/^EXCLUDED/d' "${CIS_CONF_DIR}/conf.d/${script}.cfg" # shellcheck disable=2016 - echo 'EXCLUDED="$EXCLUDED ^/home/secaudit/6.1.11/.*"' >>"${CIS_CONF_DIR}/conf.d/${script}.cfg" + echo 'EXCLUDED="/proc|^/home/secaudit/6.1.11/.*"' >>"${CIS_CONF_DIR}/conf.d/${script}.cfg" mkdir /home/secaudit/6.1.11/ touch /home/secaudit/6.1.11/test chown 1200 /home/secaudit/6.1.11/test @@ -25,17 +26,20 @@ test_audit() { run noncompliant "${CIS_CHECKS_DIR}/${script}.sh" --audit-all describe Tests failing with find ignore flag + sed -i '/^FIND_IGNORE_NOSUCHFILE_ERR/d' "${CIS_CONF_DIR}/conf.d/${script}.cfg" echo 'FIND_IGNORE_NOSUCHFILE_ERR=true' >>"${CIS_CONF_DIR}/conf.d/${script}.cfg" register_test retvalshouldbe 1 register_test contain "Some unowned files are present" run noncompliant "${CIS_CHECKS_DIR}/${script}.sh" --audit-all describe correcting situation - sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg" + sed -i '/^status/s/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg" "${CIS_CHECKS_DIR}/${script}.sh" || true describe Checking resolved state register_test retvalshouldbe 0 register_test contain "No unowned files found" run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all + + rm -rf /home/secaudit/6.1.11 /home/secaudit/unowned }