Skip to content

Commit 334d743

Browse files
thibaultsertithibaultserti
authored
fix EXCEPTIONS management (#104)
* FIX(1.1.21, 6.1.10) fix EXCEPTIONS management * Update changelog * Refactor test for 6.1.10-14
1 parent 4ed8adf commit 334d743

11 files changed

+118
-131
lines changed

‎bin/hardening/1.1.21_sticky_bit_world_writable_folder.sh

Lines changed: 17 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -23,21 +23,14 @@ EXCEPTIONS=''
2323
audit() {
2424
info "Checking if setuid is set on world writable Directories"
2525
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}')
26-
# shellcheck disable=SC2086
27-
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null)
28-
IFS_BAK=$IFS
29-
IFS=$'\n'
30-
for LINE in $RESULT; do
31-
debug "line : $LINE"
32-
if echo "$EXCEPTIONS" | grep -q "$LINE"; then
33-
debug "$LINE is confirmed as an exception"
34-
# shellcheck disable=SC2001
35-
RESULT=$(sed "s!$LINE!!" <<<"$RESULT")
36-
else
37-
debug "$LINE not found in exceptions"
38-
fi
39-
done
40-
IFS=$IFS_BAK
26+
if [ -n "$EXCEPTIONS" ]; then
27+
# shellcheck disable=SC2086
28+
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -regextype 'egrep' ! -regex $EXCEPTIONS -print 2>/dev/null)
29+
else
30+
# shellcheck disable=SC2086
31+
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null)
32+
fi
33+
4134
if [ -n "$RESULT" ]; then
4235
crit "Some world writable directories are not on sticky bit mode!"
4336
# shellcheck disable=SC2001
@@ -50,20 +43,13 @@ audit() {
5043

5144
# This function will be called if the script status is on enabled mode
5245
apply() {
53-
RESULT=$(df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null)
54-
IFS_BAK=$IFS
55-
IFS=$'\n'
56-
for LINE in $RESULT; do
57-
debug "line : $LINE"
58-
if echo "$EXCEPTIONS" | grep -q "$ACCOUNT"; then
59-
debug "$ACCOUNT is confirmed as an exception"
60-
# shellcheck disable=SC2001
61-
RESULT=$(sed "s!$LINE!!" <<<"$RESULT")
62-
else
63-
debug "$ACCOUNT not found in exceptions"
64-
fi
65-
done
66-
IFS=$IFS_BAK
46+
if [ -n "$EXCEPTIONS" ]; then
47+
# shellcheck disable=SC2086
48+
RESULT=$(df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -regextype 'egrep' ! -regex $EXCEPTIONS -print 2>/dev/null)
49+
else
50+
RESULT=$(df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print 2>/dev/null)
51+
fi
52+
6753
if [ -n "$RESULT" ]; then
6854
warn "Setting sticky bit on world writable directories"
6955
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type d -perm -0002 2>/dev/null | xargs chmod a+t
@@ -72,20 +58,10 @@ apply() {
7258
fi
7359
}
7460

75-
# This function will create the config file for this check with default values
76-
create_config() {
77-
cat <<EOF
78-
status=audit
79-
# Put here your exceptions separated by spaces
80-
EXCEPTIONS=""
81-
EOF
82-
}
83-
8461
# This function will check config parameters required
8562
check_config() {
86-
if [ -z "$EXCEPTIONS" ]; then
87-
EXCEPTIONS="@"
88-
fi
63+
# No param for this function
64+
:
8965
}
9066

9167
# Source Root Dir Parameter

‎bin/hardening/6.1.10_find_world_writable_file.sh

Lines changed: 19 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -17,27 +17,21 @@ HARDENING_LEVEL=3
1717
# shellcheck disable=2034
1818
DESCRIPTION="Ensure no world writable files exist"
1919

20-
EXCEPTIONS=''
20+
EXCLUDED=''
2121

2222
# This function will be called if the script status is on enabled / audit mode
2323
audit() {
2424
info "Checking if there are world writable files"
2525
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}')
26-
# shellcheck disable=SC2086
27-
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -type f -perm -0002 -print 2>/dev/null)
28-
IFS_BAK=$IFS
29-
IFS=$'\n'
30-
for LINE in $RESULT; do
31-
debug "line : $LINE"
32-
if echo "$EXCEPTIONS" | grep -q "$LINE"; then
33-
debug "$LINE is confirmed as an exception"
34-
# shellcheck disable=SC2001
35-
RESULT=$(sed "s!$LINE!!" <<<"$RESULT")
36-
else
37-
debug "$LINE not found in exceptions"
38-
fi
39-
done
40-
IFS=$IFS_BAK
26+
27+
if [ -n "$EXCLUDED" ]; then
28+
# shellcheck disable=SC2086
29+
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -type f -perm -0002 -regextype 'egrep' ! -regex $EXCLUDED -print 2>/dev/null)
30+
else
31+
# shellcheck disable=SC2086
32+
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -type f -perm -0002 -print 2>/dev/null)
33+
fi
34+
4135
if [ -n "$RESULT" ]; then
4236
crit "Some world writable files are present"
4337
# shellcheck disable=SC2001
@@ -50,20 +44,13 @@ audit() {
5044

5145
# This function will be called if the script status is on enabled mode
5246
apply() {
53-
RESULT=$(df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type f -perm -0002 -print 2>/dev/null)
54-
IFS_BAK=$IFS
55-
IFS=$'\n'
56-
for LINE in $RESULT; do
57-
debug "line : $LINE"
58-
if echo "$EXCEPTIONS" | grep -q "$ACCOUNT"; then
59-
debug "$ACCOUNT is confirmed as an exception"
60-
# shellcheck disable=SC2001
61-
RESULT=$(sed "s!$LINE!!" <<<"$RESULT")
62-
else
63-
debug "$ACCOUNT not found in exceptions"
64-
fi
65-
done
66-
IFS=$IFS_BAK
47+
if [ -n "$EXCLUDED" ]; then
48+
# shellcheck disable=SC2086
49+
RESULT=$(df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type f -perm -0002 -regextype 'egrep' ! -regex $EXCLUDED -print 2>/dev/null)
50+
else
51+
RESULT=$(df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type f -perm -0002 -print 2>/dev/null)
52+
fi
53+
6754
if [ -n "$RESULT" ]; then
6855
warn "chmoding o-w all files in the system"
6956
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type f -perm -0002 -print 2>/dev/null | xargs chmod o-w
@@ -72,20 +59,10 @@ apply() {
7259
fi
7360
}
7461

75-
# This function will create the config file for this check with default values
76-
create_config() {
77-
cat <<EOF
78-
status=audit
79-
# Put here your exceptions separated by spaces
80-
EXCEPTIONS=""
81-
EOF
82-
}
83-
8462
# This function will check config parameters required
8563
check_config() {
86-
if [ -z "$EXCEPTIONS" ]; then
87-
EXCEPTIONS="@"
88-
fi
64+
# No param for this function
65+
:
8966
}
9067

9168
# Source Root Dir Parameter

‎bin/hardening/6.1.11_find_unowned_files.sh

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ audit() {
2626
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}')
2727
if [ -n "$EXCLUDED" ]; then
2828
# shellcheck disable=SC2086
29-
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -nouser -regextype 'egrep' ! -regex "$EXCLUDED" -print 2>/dev/null)
29+
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -nouser -regextype 'egrep' ! -regex $EXCLUDED -print 2>/dev/null)
3030
else
3131
# shellcheck disable=SC2086
3232
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -nouser -print 2>/dev/null)
@@ -44,7 +44,8 @@ audit() {
4444
# This function will be called if the script status is on enabled mode
4545
apply() {
4646
if [ -n "$EXCLUDED" ]; then
47-
RESULT=$(df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -nouser -regextype 'egrep' ! -regex "$EXCLUDED" -ls 2>/dev/null)
47+
# shellcheck disable=SC2086
48+
RESULT=$(df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -nouser -regextype 'egrep' ! -regex $EXCLUDED -ls 2>/dev/null)
4849
else
4950
RESULT=$(df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -nouser -ls 2>/dev/null)
5051
fi

‎bin/hardening/6.1.12_find_ungrouped_files.sh

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ audit() {
2626
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}')
2727
if [ -n "$EXCLUDED" ]; then
2828
# shellcheck disable=SC2086
29-
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -nogroup -regextype 'egrep' ! -regex "$EXCLUDED" -print 2>/dev/null)
29+
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -nogroup -regextype 'egrep' ! -regex $EXCLUDED -print 2>/dev/null)
3030
else
3131
# shellcheck disable=SC2086
3232
RESULT=$($SUDO_CMD find $FS_NAMES -xdev -nogroup -print 2>/dev/null)
@@ -44,7 +44,8 @@ audit() {
4444
# This function will be called if the script status is on enabled mode
4545
apply() {
4646
if [ -n "$EXCLUDED" ]; then
47-
RESULT=$(df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -nogroup -regextype 'egrep' ! -regex "$EXCLUDED" -ls 2>/dev/null)
47+
# shellcheck disable=SC2086
48+
RESULT=$(df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -nogroup -regextype 'egrep' ! -regex $EXCLUDED -ls 2>/dev/null)
4849
else
4950
RESULT=$(df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -nogroup -ls 2>/dev/null)
5051
fi

‎bin/hardening/6.1.13_find_suid_files.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ audit() {
2424
FS_NAMES=$(df --local -P | awk '{ if (NR!=1) print $6 }')
2525
# shellcheck disable=2086
2626
if [ -n "$IGNORED_PATH" ]; then
27-
FOUND_BINARIES=$($SUDO_CMD find $FS_NAMES -xdev -type f -perm -4000 -regextype 'egrep' ! -regex "$IGNORED_PATH" -print)
27+
FOUND_BINARIES=$($SUDO_CMD find $FS_NAMES -xdev -type f -perm -4000 -regextype 'egrep' ! -regex $IGNORED_PATH -print)
2828
else
2929
FOUND_BINARIES=$($SUDO_CMD find $FS_NAMES -xdev -type f -perm -4000 -print)
3030
fi

‎bin/hardening/6.1.14_find_sgid_files.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ audit() {
2424
FS_NAMES=$(df --local -P | awk '{ if (NR!=1) print $6 }')
2525
# shellcheck disable=2086
2626
if [ -n "$IGNORED_PATH" ]; then
27-
FOUND_BINARIES=$($SUDO_CMD find $FS_NAMES -xdev -type f -perm -2000 -regextype 'egrep' ! -regex "$IGNORED_PATH" -print)
27+
FOUND_BINARIES=$($SUDO_CMD find $FS_NAMES -xdev -type f -perm -2000 -regextype 'egrep' ! -regex $IGNORED_PATH -print)
2828
else
2929
FOUND_BINARIES=$($SUDO_CMD find $FS_NAMES -xdev -type f -perm -2000 -print)
3030
fi

‎debian/changelog

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
cis-hardening (3.1-6) unstable; urgency=medium
2+
3+
* Improve EXCEPTIONS management (1.1.21,6.1.10)
4+
* Fix bug linked with regex quoting (6.1.10-11-12-13-14)
5+
6+
-- Thibault Ayanides <[email protected]> Wed, 02 Jun 2021 09:45:40 +0200
7+
18
cis-hardening (3.1-5) unstable; urgency=medium
29

310
* Fix unbound EXCEPTIONS variable in some cases

‎tests/hardening/1.1.21_sticky_bit_world_writable_folder.sh

Lines changed: 24 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,35 @@
11
# shellcheck shell=bash
22
# run-shellcheck
33
test_audit() {
4+
describe Running void to generate the conf file that will later be edited
5+
# shellcheck disable=2154
6+
/opt/debian-cis/bin/hardening/"${script}".sh || true
7+
# shellcheck disable=2016
8+
echo 'EXCEPTIONS="$EXCEPTIONS /home/secaudit/exception"' >>/opt/debian-cis/etc/conf.d/"${script}".cfg
9+
mkdir /home/secaudit/exception
10+
chmod 777 /home/secaudit/exception
11+
412
describe Running on blank host
513
register_test retvalshouldbe 0
614
register_test contain "All world writable directories have a sticky bit"
715
# shellcheck disable=2154
816
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
9-
if [ -f "/.dockerenv" ]; then
10-
skip "SKIPPED on docker"
11-
else
12-
describe Tests purposely failing
13-
local targetdir="/home/secaudit/world_writable_folder"
14-
mkdir $targetdir || true
15-
chmod 777 "$targetdir"
16-
register_test retvalshouldbe 1
17-
register_test contain "Some world writable directories are not on sticky bit mode"
18-
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
1917

20-
describe correcting situation
21-
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
22-
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
18+
describe Tests purposely failing
19+
local targetdir="/home/secaudit/world_writable_folder"
20+
mkdir $targetdir || true
21+
chmod 777 "$targetdir"
22+
register_test retvalshouldbe 1
23+
register_test contain "Some world writable directories are not on sticky bit mode"
24+
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
25+
26+
describe correcting situation
27+
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
28+
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
29+
30+
describe Checking resolved state
31+
register_test retvalshouldbe 0
32+
register_test contain "All world writable directories have a sticky bit"
33+
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
2334

24-
describe Checking resolved state
25-
register_test retvalshouldbe 0
26-
register_test contain "All world writable directories have a sticky bit"
27-
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
28-
fi
2935
}

‎tests/hardening/6.1.10_find_world_writable_file.sh

Lines changed: 25 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,33 @@
11
# shellcheck shell=bash
22
# run-shellcheck
33
test_audit() {
4+
describe Running void to generate the conf file that will later be edited
5+
# shellcheck disable=2154
6+
/opt/debian-cis/bin/hardening/"${script}".sh || true
7+
# shellcheck disable=2016
8+
echo 'EXCLUDED="$EXCLUDED ^/dev/.*"' >>/opt/debian-cis/etc/conf.d/"${script}".cfg
49

5-
#run this test only if we're not in docker
6-
if [ -f "/.dockerenv" ]; then
7-
skip "SKIPPED on docker"
8-
else
9-
describe Running on blank host
10-
register_test retvalshouldbe 0
11-
register_test contain "No world writable files found"
12-
# shellcheck disable=2154
13-
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
10+
describe Running on blank host
11+
register_test retvalshouldbe 0
12+
register_test contain "No world writable files found"
13+
# shellcheck disable=2154
14+
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
1415

15-
describe Tests purposely failing
16-
local targetfile="/home/secaudit/worldwritable"
17-
touch "$targetfile"
18-
chmod 777 "$targetfile"
19-
register_test retvalshouldbe 1
20-
register_test contain "Some world writable files are present"
21-
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
16+
describe Tests purposely failing
17+
local targetfile="/home/secaudit/worldwritable"
18+
touch "$targetfile"
19+
chmod 777 "$targetfile"
20+
register_test retvalshouldbe 1
21+
register_test contain "Some world writable files are present"
22+
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
2223

23-
describe correcting situation
24-
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
25-
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
24+
describe correcting situation
25+
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
26+
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
27+
28+
describe Checking resolved state
29+
register_test retvalshouldbe 0
30+
register_test contain "No world writable files found"
31+
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
2632

27-
describe Checking resolved state
28-
register_test retvalshouldbe 0
29-
register_test contain "No world writable files found"
30-
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
31-
fi
3233
}

‎tests/hardening/6.1.11_find_unowned_files.sh

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,15 @@
11
# shellcheck shell=bash
22
# run-shellcheck
33
test_audit() {
4+
describe Running void to generate the conf file that will later be edited
5+
# shellcheck disable=2154
6+
/opt/debian-cis/bin/hardening/"${script}".sh || true
7+
# shellcheck disable=2016
8+
echo 'EXCLUDED="$EXCLUDED ^/home/secaudit/6.1.11/.*"' >>/opt/debian-cis/etc/conf.d/"${script}".cfg
9+
mkdir /home/secaudit/6.1.11/
10+
touch /home/secaudit/6.1.11/test
11+
chown 1200 /home/secaudit/6.1.11/test
12+
413
describe Running on blank host
514
register_test retvalshouldbe 0
615
register_test contain "No unowned files found"

0 commit comments

Comments
 (0)