mirror of
https://github.com/CISOfy/lynis.git
synced 2026-03-11 08:55:28 +00:00
e054e9757c
* Description fix: SafePerms works on files not dirs.
All uses of SafePerms are on files (and indeed, it would reject
directories which would have +x set).
* Lots of whitespace cleanups.
Enforce everywhere(?) the same indentations for if/fi blocks.
The standard for the Lynis codebase is 4 spaces. But sometimes
it's 1, sometimes 3, sometimes 8.
These patches standardize all(?) if blocks but _not_ else's (which
are usually indented 2, but sometimes zero); I was too lazy to
identify those (see below).
This diff is giant, but should not change code behavior at all;
diff -w shows no changes apart from whitespace.
FWIW I identified instances to check by using:
perl -ne 'if ($oldfile ne $ARGV) { $.=1; $oldfile=$ARGV; }; chomp; if ($spaces) { next unless /^( *)([^ ]+)/; $newspaces=length($1); $firsttok = $2; next unless defined($firsttok); $offset = ($firsttok eq "elif" ? 0 : 4); if ($newspaces != $spaces + $offset) { print "$ARGV:$ifline\n$ARGV:$.:$_\n\n" }; $ifline=""; $spaces=""; } if (/^( *)if (?!.*[; ]fi)/) { $ifline = "$.:$_"; $spaces = length($1); }' $(find . -type f -print0 | xargs -0 file | egrep shell | cut -d: -f1)
Which produced output like:
./extras/build-lynis.sh:217: if [ ${VERSION_IN_SPECFILE} = "" -o ! "${VERSION_IN_SPECFILE}" = "${LYNIS_VERSION}" ]; then
./extras/build-lynis.sh:218: echo "[X] Version in specfile is outdated"
./plugins/plugin_pam_phase1:69: if [ -d ${PAM_DIRECTORY} ]; then
./plugins/plugin_pam_phase1:70: LogText "Result: /etc/pam.d exists"
...There's probably formal shellscript-beautification tools that
I'm oblivious about.
* More whitespace standardization.
* Fix a syntax error.
This looks like an if [ foo -o bar ]; was converted to if .. elif,
but incompletely.
* Add whitespace before closing ].
Without it, the shell thinks the ] is part of the last string, and
emits warnings like:
.../lynis/include/tests_authentication: line 1028: [: missing `]'
218 lines
11 KiB
Bash
218 lines
11 KiB
Bash
#!/bin/sh
|
|
|
|
#################################################################################
|
|
#
|
|
# Lynis
|
|
# ------------------
|
|
#
|
|
# Copyright 2007-2013, Michael Boelen
|
|
# Copyright 2007-2017, CISOfy
|
|
#
|
|
# Website : https://cisofy.com
|
|
# Blog : http://linux-audit.com
|
|
# GitHub : https://github.com/CISOfy/lynis
|
|
#
|
|
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
|
|
# welcome to redistribute it under the terms of the GNU General Public License.
|
|
# See LICENSE file for usage of this software.
|
|
#
|
|
#################################################################################
|
|
#
|
|
APPARMORFOUND=0 # Set default for test MACF-6208
|
|
MAC_FRAMEWORK_ACTIVE=0 # Default no MAC framework active
|
|
RBAC_FRAMEWORK_ACTIVE=0 # Default no RBAC framework active
|
|
SELINUXFOUND=0
|
|
|
|
InsertSection "Security frameworks"
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : MACF-6204
|
|
# Description : Check if AppArmor is installed
|
|
Register --test-no MACF-6204 --weight L --network NO --category security --description "Check AppArmor presence"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
if [ -z "${AASTATUSBINARY}" ]; then
|
|
APPARMORFOUND=0
|
|
LogText "Result: aa-status binary not found, AppArmor not installed"
|
|
Display --indent 2 --text "- Checking presence AppArmor" --result "${STATUS_NOT_FOUND}" --color WHITE
|
|
else
|
|
APPARMORFOUND=1
|
|
LogText "Result: aa-status binary found, AppArmor is installed"
|
|
Display --indent 2 --text "- Checking presence AppArmor" --result "${STATUS_FOUND}" --color GREEN
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : MACF-6208
|
|
# Description : Check AppArmor active status
|
|
if [ ${APPARMORFOUND} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no MACF-6208 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check if AppArmor is enabled"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
if [ ! -z "${AASTATUSBINARY}" ]; then
|
|
CAN_READ_FILE=0
|
|
FILE="/sys/kernel/security/apparmor/profiles"
|
|
if [ -f ${FILE} ]; then
|
|
FIND=$(${CAT_BINARY} ${FILE} 2> /dev/null)
|
|
if [ $? -eq 0 ]; then CAN_READ_FILE=1; fi
|
|
else
|
|
LogText "File ${FILE} does not exist"
|
|
fi
|
|
if [ ${CAN_READ_FILE} -eq 1 ]; then
|
|
LogText "Result: file ${FILE} is available and readable"
|
|
# Checking AppArmor status
|
|
# 0 if apparmor is enabled and policy is loaded.
|
|
# 1 if apparmor is not enabled/loaded.
|
|
# 2 if apparmor is enabled but no policy is loaded.
|
|
# 3 if control files are not available
|
|
# 4 if apparmor status can't be read
|
|
FIND=$(${AASTATUSBINARY} 2>&1 > /dev/null)
|
|
if [ $? -eq 0 ]; then
|
|
MAC_FRAMEWORK_ACTIVE=1
|
|
LogText "Result: AppArmor is enabled and a policy is loaded"
|
|
Display --indent 4 --text "- Checking AppArmor status" --result "${STATUS_ENABLED}" --color GREEN
|
|
Report "apparmor_enabled=1"
|
|
Report "apparmor_policy_loaded=1"
|
|
AddHP 3 3
|
|
elif [ $? -eq 4 ]; then
|
|
LogText "Result: Can not determine status, most likely due to lacking permissions"
|
|
Display --indent 4 --text "- Checking AppArmor status" --result "${STATUS_UNKNOWN}" --color RED
|
|
elif [ $? -eq 3 ]; then
|
|
LogText "Result: Can not check control files"
|
|
Display --indent 4 --text "- Checking AppArmor status" --result "${STATUS_UNKNOWN}" --color RED
|
|
elif [ $? -eq 2 ]; then
|
|
LogText "Result: AppArmor is enabled, but no policy is loaded"
|
|
ReportSuggestion ${TEST_NO} "Load AppArmor policies"
|
|
Display --indent 4 --text "- Checking AppArmor status" --result "NON-ACTIVE" --color GREEN
|
|
Report "apparmor_enabled=1"
|
|
Report "apparmor_policy_loaded=0"
|
|
AddHP 0 3
|
|
elif [ $? -eq 1 ]; then
|
|
LogText "Result: AppArmor is disabled"
|
|
Display --indent 4 --text "- Checking AppArmor status" --result "${STATUS_DISABLED}" --color YELLOW
|
|
Report "apparmor_enabled=0"
|
|
AddHP 0 3
|
|
else
|
|
Display --indent 4 --text "- Checking AppArmor status" --result "${STATUS_UNKNOWN}" --color RED
|
|
ReportException "${TEST_NO}:1" "Invalid or unknown AppArmor status detected"
|
|
fi
|
|
else
|
|
LogText "Result: could not find or read ${FILE}"
|
|
Display --indent 4 --text "- Checking AppArmor status" --result "${STATUS_UNKNOWN}" --color YELLOW
|
|
ReportSuggestion "${TEST_NO}" "Check output of aa-status" "${FILE}" "text:Run aa-status"
|
|
fi
|
|
else
|
|
LogText "Result: no aa-status binary available"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : MACF-6232
|
|
# Description : Check SELINUX for installation
|
|
Register --test-no MACF-6232 --weight L --network NO --category security --description "Check SELINUX presence"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
LogText "Test: checking if we have sestatus binary"
|
|
if [ ! -z "${SESTATUSBINARY}" ]; then
|
|
LogText "Result: found sestatus binary (${SESTATUSBINARY})"
|
|
Display --indent 2 --text "- Checking presence SELinux" --result "${STATUS_FOUND}" --color GREEN
|
|
else
|
|
LogText "Result: sestatus binary NOT found"
|
|
Display --indent 2 --text "- Checking presence SELinux" --result "${STATUS_NOT_FOUND}" --color WHITE
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : MACF-6234
|
|
# Description : Check SELINUX status
|
|
if [ ! "${SESTATUSBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no MACF-6234 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check SELINUX status"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
# Status: Enabled/Disabled
|
|
FIND=$(${SESTATUSBINARY} | ${GREPBINARY} "^SELinux status" | ${AWKBINARY} '{ print $3 }')
|
|
if [ "${FIND}" = "enabled" ]; then
|
|
MAC_FRAMEWORK_ACTIVE=1
|
|
LogText "Result: SELinux framework is enabled"
|
|
Report "selinux_status=1"
|
|
SELINUXFOUND=1
|
|
Display --indent 4 --text "- Checking SELinux status" --result "${STATUS_ENABLED}" --color GREEN
|
|
FIND=$(${SESTATUSBINARY} | ${GREPBINARY} "^Current mode" | ${AWKBINARY} '{ print $3 }')
|
|
Report "selinux_mode=${FIND}"
|
|
FIND2=$(${SESTATUSBINARY} | ${GREPBINARY} "^Mode from config file" | ${AWKBINARY} '{ print $5 }')
|
|
LogText "Result: current SELinux mode is ${FIND}"
|
|
LogText "Result: mode configured in config file is ${FIND2}"
|
|
if [ "${FIND}" = "${FIND2}" ]; then
|
|
LogText "Result: Current SELinux mode is the same as in config file."
|
|
Display --indent 6 --text "- Checking current mode and config file" --result "${STATUS_OK}" --color GREEN
|
|
else
|
|
LogText "Result: Current SELinux mode (${FIND}) is NOT the same as in config file (${FIND2})."
|
|
ReportWarning ${TEST_NO} "Current SELinux mode is different from config file (current: ${FIND}, config file: ${FIND2})"
|
|
Display --indent 6 --text "- Checking current mode and config file" --result "${STATUS_WARNING}" --color RED
|
|
fi
|
|
Display --indent 8 --text "Current SELinux mode: ${FIND}"
|
|
else
|
|
LogText "Result: SELinux framework is disabled"
|
|
Display --indent 4 --text "- Checking SELinux status" --result "${STATUS_DISABLED}" --color YELLOW
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : RBAC-6272
|
|
# Description : Check if grsecurity is installed
|
|
# Notes : We already checked grsecurity in osdetection
|
|
Register --test-no RBAC-6272 --weight L --network NO --category security --description "Check grsecurity presence"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
# Check Linux kernel configuration
|
|
if [ ! -z "${LINUXCONFIGFILE}" -a -f "${LINUXCONFIGFILE}" ]; then
|
|
FIND=$(${GREPBINARY} ^CONFIG_GRKERNSEC=y ${LINUXCONFIGFILE})
|
|
if [ ! "${FIND}" = "" ]; then
|
|
LogText "Result: grsecurity available (in kernel config)"
|
|
GRSEC_FOUND=1
|
|
else
|
|
LogText "Result: no grsecurity found in kernel config"
|
|
fi
|
|
fi
|
|
if [ ${GRSEC_FOUND} -eq 1 ]; then
|
|
Display --indent 2 --text "- Checking presence grsecurity" --result "${STATUS_FOUND}" --color GREEN
|
|
AddHP 3 3
|
|
else
|
|
Display --indent 2 --text "- Checking presence grsecurity" --result "${STATUS_NOT_FOUND}" --color WHITE
|
|
fi
|
|
if [ ! -z "${GRADMBINARY}" ]; then
|
|
FIND=$(${GRADMBINARY} --status)
|
|
if [ "${FIND}" = "The RBAC system is currently enabled." ]; then
|
|
MAC_FRAMEWORK_ACTIVE=1
|
|
fi
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : MACF-6290
|
|
# Description : Check if at least one MAC framework is implemented
|
|
Register --test-no MACF-6290 --weight L --network NO --category security --description "Check for implemented MAC framework"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
if [ ${MAC_FRAMEWORK_ACTIVE} -eq 1 ]; then
|
|
Display --indent 2 --text "- Checking for implemented MAC framework" --result "${STATUS_OK}" --color GREEN
|
|
AddHP 3 3
|
|
LogText "Result: found implemented MAC framework"
|
|
else
|
|
Display --indent 2 --text "- Checking for implemented MAC framework" --result "${STATUS_NONE}" --color YELLOW
|
|
AddHP 2 3
|
|
LogText "Result: found no implemented MAC framework"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
|
|
Report "framework_grsecurity=${GRSEC_FOUND}"
|
|
Report "framework_selinux=${SELINUXFOUND}"
|
|
|
|
WaitForKeyPress
|
|
|
|
#
|
|
#================================================================================
|
|
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com
|