mirror of
https://github.com/ovh/debian-cis.git
synced 2024-11-23 05:55:38 +01:00
18693200dc
Add usecase in basename Add test files for checks with find command Always show logs FIX: run void script to generate config and avoid sed failure Update README with functional test description Add skeleton for functional test Add argument to launch only specific test suite Add support for debian8 and compulsory mention of debian version at launch Improve README Simplify test file syntax to avoid copy/paste mistake Add script that runs tests on all debian targets Improve run_all_target script with nowait and nodel options Add dockerfile for Buster pre-version Chore: Use getopt for options and reviewed code by shellcheck Add trap to ensure cleanup on exit/interrupt Remove quotes that lead to `less` misinterpretation of the filenames Set `local` for variables inside `test_audit` func Move functional assertion functions to dedicated file Add cleanup for logs and containers Improve cleanup, and now exits Apply shellcheck recommendations FIX: allow script to be run from anywhere (dirname $0) Changes to be committed: modified: README.md new file: src/skel.test new file: tests/docker/Dockerfile.debian10_20181226 new file: tests/docker/Dockerfile.debian8 new file: tests/docker/Dockerfile.debian9 new file: tests/docker_build_and_run_tests.sh new file: tests/hardening/12.10_find_suid_files.sh new file: tests/hardening/12.11_find_sgid_files.sh new file: tests/hardening/12.7_find_world_writable_file.sh new file: tests/hardening/12.8_find_unowned_files.sh new file: tests/hardening/12.9_find_ungrouped_files.sh new file: tests/hardening/2.17_sticky_bit_world_writable_folder.sh new file: tests/launch_tests.sh new file: tests/lib.sh new file: tests/run_all_targets.sh
92 lines
2.5 KiB
Bash
92 lines
2.5 KiB
Bash
# shellcheck shell=bash
|
|
###########################################
|
|
# Assertion functions for funcional tests #
|
|
###########################################
|
|
|
|
# sugar to add a decription of the test suite
|
|
# describe <STRING>
|
|
describe() {
|
|
# shellcheck disable=2154
|
|
printf "\033[36mxxx %s::%s \033[0m\n" "$name" "$*"
|
|
}
|
|
|
|
# Register an assertion on an audit before running it
|
|
# May be used several times
|
|
# See below assertion functions
|
|
# register_test <TEST_STRING>
|
|
register_test() {
|
|
export numtest=0
|
|
if [[ "notempty" == "${REGISTERED_TESTS[*]:+notempty}" ]]; then
|
|
numtest=${#REGISTERED_TESTS[@]}
|
|
fi
|
|
REGISTERED_TESTS[numtest]="$*"
|
|
}
|
|
|
|
# retvalshouldbe checks that the audit return value equals the one passed as parameter
|
|
# retvalshoudbe <NUMBER>
|
|
retvalshouldbe()
|
|
{
|
|
# shellcheck disable=2154
|
|
retfile=$outdir/${usecase_name}.retval
|
|
shouldbe=$1
|
|
got=$(< "$retfile")
|
|
if [ "$got" = "$shouldbe" ] ; then
|
|
ok "RETURN VALUE" "($shouldbe)"
|
|
else
|
|
if [ 0 -eq "$dismiss_count" ]; then
|
|
nbfailedret=$(( nbfailedret + 1 ))
|
|
listfailedret="$listfailedret $usecase_name"
|
|
fi
|
|
fail "RETURN VALUE" "(got $got instead of $shouldbe)"
|
|
fi
|
|
}
|
|
|
|
# contain looks for a string in audit logfile
|
|
# contain [REGEX] <STRING|regexSTRING>
|
|
contain()
|
|
{
|
|
local specialoption=''
|
|
if [ "$1" != "REGEX" ] ; then
|
|
specialoption='-F'
|
|
else
|
|
specialoption='-E'
|
|
shift
|
|
fi
|
|
file=$outdir/${usecase_name}.log
|
|
pattern=$*
|
|
if grep -q $specialoption -- "$pattern" "$file"; then
|
|
ok "MUST CONTAIN" "($pattern)"
|
|
else
|
|
if [ 0 -eq "$dismiss_count" ]; then
|
|
nbfailedgrep=$(( nbfailedgrep + 1 ))
|
|
listfailedgrep="$listfailedgrep $usecase_name"
|
|
fi
|
|
fail "MUST CONTAIN" "($pattern)"
|
|
fi
|
|
}
|
|
|
|
# test is expected to fail (for instance on blank system)
|
|
# then the test wont be taken into account for test suite success
|
|
dismiss_count_for_test() {
|
|
dismiss_count=1
|
|
}
|
|
|
|
# Run the audit script in both root and sudo mode and plays assertion tests and
|
|
# sudo/root consistency tests
|
|
# run <USECASE> <AUDIT_SCRIPT>
|
|
run() {
|
|
usecase=$1
|
|
shift
|
|
usecase_name_root=$(make_usecase_name "$usecase" "root")
|
|
_run "$usecase_name_root" "$@"
|
|
play_registered_tests "$usecase_name_root"
|
|
|
|
usecase_name_sudo=$(make_usecase_name "$usecase" "sudo")
|
|
_run "$usecase_name_sudo" "sudo -u secaudit" "$@" "--sudo"
|
|
play_registered_tests "$usecase_name_sudo"
|
|
|
|
play_consistency_tests
|
|
clear_registered_tests
|
|
}
|
|
|