Update changelog for release 3.2-2 (#135)

Signed-off-by: Tarik Megzari <tarik.megzari@corp.ovh.com>

Co-authored-by: Tarik Megzari <tarik.megzari@corp.ovh.com>

debian/changelog

@@ -1,3 +1,25 @@
+cis-hardening (3.2-2) unstable; urgency=medium
+
+  * Fix empty fstab test 
+
+ -- Tarik Megzari <tarik.megzari@corp.ovh.com>  Wed, 08 Dec 2021 13:59:49 +0100
+
+cis-hardening (3.2-1) unstable; urgency=medium
+
+  - Skip NTP and Chrony config check if they are not installed (#120)
+  - Fix 3.4.2 audit rule (#123)
+  - Fix grub detection (#119)
+  - Allow grub.cfg permission to be 600 (#121)
+  - Honor --set-log-level parameter (#127)
+  - fix: kernel module detection (#129)
+  - Add silent mode and json summary (#128)
+  - FIX(1.7.1.4): don't abort script in case of unconfined processes (#130)
+  - FIX(2.2.1.4): Validate debian default ntp config (#118)
+  - 99.5.4.5.2: fix bug where sha512 option rounds provoke KO (#112)
+  - Fix 5.4.5 pattern search (#108)
+
+ -- Thibault Dewailly <thibault.dewailly@ovhcloud.com>  Wed, 01 Dec 2021 10:56:47 +0000
+
 cis-hardening (3.1-6) unstable; urgency=medium
 
   * Improve EXCEPTIONS management (1.1.21,6.1.10)

lib/utils.sh

@@ -415,9 +415,9 @@ is_kernel_option_enabled() {
 is_a_partition() {
     local PARTITION=$1
     FNRET=128
-    if [ ! -f /etc/fstab ] || [ -n "$(sed '/^#/d' /etc/fstab)" ]; then
+    if [ ! -f /etc/fstab ] || [ -z "$(sed '/^#/d' /etc/fstab)" ]; then
         debug "/etc/fstab not found or empty, searching mountpoint"
-        if mountpoint "$PARTITION" | grep -qE ".*is a mountpoint.*"; then
+        if mountpoint -q "$PARTITION"; then
             FNRET=0
         fi
     else
@@ -448,8 +448,8 @@ is_mounted() {
 has_mount_option() {
     local PARTITION=$1
     local OPTION=$2
-    if [ ! -f /etc/fstab ] || [ -n "$(sed '/^#/d' /etc/fstab)" ]; then
-        debug "/etc/fstab not found or empty, readin current mount options"
+    if [ ! -f /etc/fstab ] || [ -z "$(sed '/^#/d' /etc/fstab)" ]; then
+        debug "/etc/fstab not found or empty, reading current mount options"
         has_mounted_option "$PARTITION" "$OPTION"
     else
         if grep "[[:space:]]${PARTITION}[[:space:]]" /etc/fstab | grep -vE "^#" | awk '{print $4}' | grep -q "bind"; then

tests/hardening/1.1.15_run_shm_nodev.sh

@@ -2,15 +2,14 @@
 # run-shellcheck
 test_audit() {
     describe Running on blank host
-    register_test retvalshouldbe 1
-    dismiss_count_for_test
+    register_test retvalshouldbe 0
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
     ln -s /dev/shm /run/shm
 
     describe Partition symlink
-    register_test retvalshouldbe 1
+    register_test retvalshouldbe 0
     run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
     # Cleanup

tests/hardening/1.1.16_run_shm_nosuid.sh

@@ -3,14 +3,13 @@
 test_audit() {
     describe Running on blank host
     register_test retvalshouldbe 0
-    dismiss_count_for_test
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
     ln -s /dev/shm /run/shm
 
     describe Partition symlink
-    register_test retvalshouldbe 1
+    register_test retvalshouldbe 0
     run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
     # Cleanup

tests/hardening/1.1.17_run_shm_noexec.sh

@@ -3,14 +3,13 @@
 test_audit() {
     describe Running on blank host
     register_test retvalshouldbe 0
-    dismiss_count_for_test
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
     ln -s /dev/shm /run/shm
 
     describe Partition symlink
-    register_test retvalshouldbe 1
+    register_test retvalshouldbe 0
     run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
     # Cleanup