chore: update script related to systemctl / service

- configure_systemd-timesync.sh:        use "is_service_enabled" instead of calling systemctl
- disable_automounting.sh:              use "manage_service" instead of "update-rc.d"
- enable_auditd.sh:                     use "manage_service" instead of "update-rc.d"
- enable_cron.sh:                       use "manage_service" instead of "update-rc.d"
- enable_syslog-ng.sh:                  use "manage_service" instead of "update-rc.d"

bin/hardening/configure_systemd-timesyncd.sh

@@ -21,8 +21,8 @@ SERVICE_NAME="systemd-timesyncd"
 
 # This function will be called if the script status is on enabled / audit mode
 audit() {
-    status=$(systemctl is-enabled "$SERVICE_NAME")
+    is_service_enabled "$SERVICE_NAME"
-    if [ "$status" = "enabled" ]; then
+    if [ "$FNRET" -eq 0 ]; then
         ok "$SERVICE_NAME is enabled"
     else
         crit "$SERVICE_NAME is disabled"

bin/hardening/disable_automounting.sh

@@ -36,7 +36,7 @@ apply() {
     is_service_enabled "$SERVICE_NAME"
     if [ "$FNRET" = 0 ]; then
         info "Disabling $SERVICE_NAME"
-        update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1
+        manage_service disable "$SERVICE_NAME"
     else
         ok "$SERVICE_NAME is disabled"
     fi

bin/hardening/enable_auditd.sh

@@ -50,8 +50,7 @@ apply() {
         ok "$SERVICE_NAME is enabled"
     else
         warn "$SERVICE_NAME is not enabled, enabling it"
-        update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1
+        manage_service enable "$SERVICE_NAME"
-        update-rc.d "$SERVICE_NAME" defaults >/dev/null 2>&1
     fi
 }
 

bin/hardening/enable_cron.sh

@@ -47,8 +47,7 @@ apply() {
         is_service_enabled "$SERVICE_NAME"
         if [ "$FNRET" != 0 ]; then
             info "Enabling $SERVICE_NAME"
-            update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1
+            manage_service enable "$SERVICE_NAME"
-            update-rc.d "$SERVICE_NAME" defaults >/dev/null 2>&1
         else
             ok "$SERVICE_NAME is enabled"
         fi

bin/hardening/enable_syslog-ng.sh

@@ -46,8 +46,7 @@ apply() {
         is_service_enabled "$SERVICE_NAME"
         if [ "$FNRET" != 0 ]; then
             info "Enabling $SERVICE_NAME"
-            update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1
+            manage_service enable "$SERVICE_NAME" >/dev/null 2>&1
-            update-rc.d "$SERVICE_NAME" defaults >/dev/null 2>&1
         else
             ok "$SERVICE_NAME is enabled"
         fi

lib/utils.sh

@@ -316,7 +316,17 @@ does_group_exist() {
 
 is_service_enabled() {
     local SERVICE=$1
-    if [ "$($SUDO_CMD find /etc/rc?.d/ -name "S*$SERVICE" -print | wc -l)" -gt 0 ]; then
+
+    # if running in a container, it does not make much sense to test for systemd / service
+    # the var "IS_CONTAINER" defined in lib/constant may not be enough, in case we are using systemd slices
+    # currently, did not find a unified way to manage all cases, so we check this only for systemctl usage
+    is_using_sbin_init
+    if [ "$FNRET" -eq 1 ]; then
+        debug "host was not started using '/sbin/init', systemd should not be available"
+        FNRET=1
+        return
+    fi
+    if $SUDO_CMD systemctl -t service is-enabled "$SERVICE" >/dev/null; then
         debug "Service $SERVICE is enabled"
         FNRET=0
     else
@@ -589,6 +599,20 @@ is_pkg_installed() {
     fi
 }
 
+is_pkg_a_dependency() {
+    # check if package is needed by another installed package
+    local PKG_NAME=$1
+    local dependencies=0
+    dependencies=$(grep -w "${PKG_NAME}$" /var/lib/dpkg/status | grep -cEi "depends|recommends")
+    if [ "$dependencies" -gt 0 ]; then
+        debug "$PKG_NAME is a dependency for another installed package"
+        FNRET=0
+    else
+        FNRET=1
+        debug "$PKG_NAME is not a dependency for another installed package"
+    fi
+}
+
 # Returns Debian major version
 
 get_debian_major_version() {
@@ -621,3 +645,26 @@ get_distribution() {
 is_running_in_container() {
     awk -F/ '$2 == "'"$1"'"' /proc/self/cgroup
 }
+
+is_using_sbin_init() {
+    FNRET=0
+    # remove '\0' to avoid 'command substitution: ignored null byte in input'
+    if [[ $($SUDO_CMD cat /proc/1/cmdline | tr -d '\0') != "/sbin/init" ]]; then
+        debug "init process is not '/sbin/init'"
+        FNRET=1
+    fi
+}
+
+manage_service() {
+    local action="$1"
+    local service="$2"
+
+    is_using_sbin_init
+    if [ "$FNRET" -ne 0 ]; then
+        debug "/sbin/init not used, systemctl wont manage service $service"
+        return
+    fi
+
+    systemctl "$action" "$service" >/dev/null 2>&1
+
+}

tests/hardening/enable_auditd.sh

@@ -1,9 +1,11 @@
 # shellcheck shell=bash
 # run-shellcheck
 test_audit() {
+    describe Prepare failing test
+    apt remove -y auditd
+
     describe Running on blank host
-    register_test retvalshouldbe 0
+    register_test retvalshouldbe 1
-    dismiss_count_for_test
     # shellcheck disable=2154
     run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
 
@@ -12,7 +14,8 @@ test_audit() {
     "${CIS_CHECKS_DIR}/${script}.sh" || true
 
     describe Checking resolved state
-    register_test retvalshouldbe 0
+    # service still wont be enabled due to tests running inside a docker container
-    register_test contain "[ OK ] auditd is enabled"
+    register_test retvalshouldbe 1
+    register_test contain "[ OK ] auditd is installed"
     run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
 }