Style improvements and hardening points

1 files changed, 125 insertions, 127 deletions

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 04e758c1..f9beaaaa 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -31,16 +31,15 @@
 #################################################################################
 #
     Display --indent 2 --text "- Searching package managers"
-
 #
 #################################################################################
 #
     # Test        : PKGS-7301
     # Description : Query FreeBSD pkg
-    if [ -x /usr/sbin/pkg ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -x ${ROOTDIR}usr/sbin/pkg ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7301 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Query NetBSD pkg"
     if [ ${SKIPTEST} -eq 0 ]; then
-        FIND=`pkg -N 2>&1; echo $?`
+        FIND=$(pkg -N 2>&1; echo $?)
         if [ "${FIND}" = "0" ]; then
             Display --indent 4 --text "- Searching packages with pkg" --result "${STATUS_FOUND}" --color GREEN
             Report "package_manager[]=pkg"
@@ -49,12 +48,12 @@
             LogText "Test: Querying pkg to get package list"
             Display --indent 6 --text "- Querying pkg for installed packages"
             LogText "Output:"; LogText "-----"
-            SPACKAGES=`/usr/sbin/pkg query %n,%v`
-            for J in ${SPACKAGES}; do
-                sPKG_NAME=`echo ${J} | ${CUTBINARY} -d ',' -f1`
-                sPKG_VERSION=`echo ${J} | ${CUTBINARY} -d ',' -f2`
+            SPACKAGES=$(${ROOTDIR}usr/sbin/pkg query %n,%v)
+            for ITEM in ${SPACKAGES}; do
+                sPKG_NAME=$(echo ${ITEM} | ${CUTBINARY} -d ',' -f1)
+                sPKG_VERSION=$(echo ${ITEM} | ${CUTBINARY} -d ',' -f2)
                 LogText "Installed package: ${sPKG_NAME} (version: ${sPKG_VERSION})"
-                INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J}"
+                INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${ITEM}"
             done
         fi
     fi
@@ -73,17 +72,16 @@
         LogText "Test: Querying pkg_info to get package list"
         Display --indent 6 --text "- Querying pkg_info for installed packages"
         LogText "Output:"; LogText "-----"
-        SPACKAGES=`/usr/sbin/pkg_info 2>&1 | ${SORTBINARY} | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f1 | ${SEDBINARY} -e 's/^\(.*\)-\([0-9].*\)$/\1,\2/g'`
-        for J in ${SPACKAGES}; do
+        SPACKAGES=$(${ROOTDIR}usr/sbin/pkg_info 2>&1 | ${SORTBINARY} | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f1 | ${SEDBINARY} -e 's/^\(.*\)-\([0-9].*\)$/\1,\2/g')
+        for ITEM in ${SPACKAGES}; do
             N=$((N + 1))
-            sPKG_NAME=`echo ${J} | ${CUTBINARY} -d ',' -f1`
-            sPKG_VERSION=`echo ${J} | ${CUTBINARY} -d ',' -f2`
+            sPKG_NAME=$(echo ${ITEM} | ${CUTBINARY} -d ',' -f1)
+            sPKG_VERSION=$(echo ${ITEM} | ${CUTBINARY} -d ',' -f2)
             LogText "Installed package: ${sPKG_NAME} (version: ${sPKG_VERSION})"
-            INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J}"
+            INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${ITEM}"
         done
         Report "installed_packages=${N}"
     fi
-
 #
 #################################################################################
 #
@@ -112,7 +110,7 @@
 #
     # Test        : PKGS-7304
     # Description : Gentoo packages
-    if [ -x /usr/bin/emerge -a -x /usr/bin/equery ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -x ${ROOTDIR}usr/bin/emerge -a -x ${ROOTDIR}usr/bin/equery ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7304 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Querying Gentoo packages"
     if [ ${SKIPTEST} -eq 0 ]; then
         Display --indent 4 --text "- Searching emerge" --result "${STATUS_FOUND}" --color GREEN
@@ -121,7 +119,7 @@
         LogText "Test: Querying portage to get package list"
         Display --indent 4 --text "- Querying portage for installed packages"
         LogText "Output:"; LogText "-----"
-        GPACKAGES=`equery l '*' | ${SEDBINARY} -e 's/[.*]//g'`
+        GPACKAGES=$(equery l '*' | ${SEDBINARY} -e 's/[.*]//g')
         for J in ${GPACKAGES}; do
             LogText "Found package ${J}"
             INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J},0,"
@@ -135,7 +133,7 @@
 #
     # Test        : PKGS-7306
     # Description : Solaris packages
-    if [ -x /usr/bin/pkginfo ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -x ${ROOTDIR}usr/bin/pkginfo ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7306 --os Solaris --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Querying Solaris packages"
     if [ ${SKIPTEST} -eq 0 ]; then
         Display --indent 4 --text "- Searching pkginfo" --result "${STATUS_FOUND}" --color GREEN
@@ -145,7 +143,7 @@
             Display --indent 4 --text "- Querying pkginfo for installed packages"
             LogText "Output:"; LogText "-----"
             # Strip SUNW from strings
-            SPACKAGES=`/usr/bin/pkginfo -i | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f2 | ${SEDBINARY} "s#^SUNW##"`
+            SPACKAGES=$(${ROOTDIR}usr/bin/pkginfo -i | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f2 | ${SEDBINARY} "s#^SUNW##")
             for J in ${SPACKAGES}; do
                 LogText "Found package ${J}"
                 INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J},0,"
@@ -176,8 +174,8 @@
           else
             for J in ${SPACKAGES}; do
                 N=$((N + 1))
-                PACKAGE_NAME=`echo ${J} | ${AWKBINARY} -F, '{print $1}'`
-                PACKAGE_VERSION=`echo ${J} | ${AWKBINARY} -F, '{print $2}'`
+                PACKAGE_NAME=$(echo ${J} | ${AWKBINARY} -F, '{print $1}')
+                PACKAGE_VERSION=$(echo ${J} | ${AWKBINARY} -F, '{print $2}')
                 LogText "Found package: ${J}"
                 INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${PACKAGE_NAME},${PACKAGE_VERSION},"
             done
@@ -205,7 +203,7 @@
         if [ "${SPACKAGES}" = "" ]; then
             LogText "Result: pacman binary available, but package list seems to be empty"
             LogText "Info: looks like the pacman binary is installed, but not used for package installation"
-          else
+        else
             for J in ${SPACKAGES}; do
                 N=$((N + 1))
                 PACKAGE_NAME=`echo ${J} | ${AWKBINARY} -F, '{ print $1 }'`
@@ -225,8 +223,8 @@
     Register --test-no PKGS-7312 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking available updates for pacman based system"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
-        FIND=`which checkupdates`
-        if [ ! "${FIND}" = "" ]; then
+        FIND=$(which checkupdates 2> /dev/null)
+        if [ ! -z "${FIND}" ]; then
             FIND=`checkupdates`
             for I in ${FIND}; do
                 LogText "Result: update available for ${I}"
@@ -236,7 +234,7 @@
             if [ ${FOUND} -eq 1 ]; then
                 Display --indent 4 --text "- Searching update status (checkupdates)" --result "OUTDATED" --color YELLOW
                 ReportSuggestion "${TEST_NO}" "Perform update of system updates as this system uses rolling updates"
-              else
+            else
                 Display --indent 4 --text "- Searching update status (checkupdates)" --result "UP-TO-DATE" --color GREEN
             fi
          else
@@ -335,7 +333,7 @@
                 INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J},0,"
             done
             Report "installed_packages=${N}"
-          else
+        else
             # Could not find any installed packages
             ReportException ${TEST_NO} "No installed packages found with Zypper"
         fi
@@ -352,7 +350,7 @@
             if [ ! "${FIND}" = "" ]; then
                 LogText "Result: No security updates found with Zypper"
                 Display --indent 2 --text "- Using Zypper to find vulnerable packages" --result "${STATUS_NONE}" --color GREEN
-              else
+            else
                 Display --indent 2 --text "- Using Zypper to find vulnerable packages" --result "${STATUS_WARNING}" --color RED
                 LogText "Result: Zypper found one or more installed packages which are vulnerable."
                 ReportWarning ${TEST_NO} "Found one or more vulnerable packages installed"
@@ -392,7 +390,7 @@
             INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${PACKAGE_NAME},${PACKAGE_VERSION}"
         done
         Report "installed_packages=${N}"
-      else
+    else
         LogText "Result: dpkg can NOT be found on this system, test skipped"
     fi
 #
@@ -410,7 +408,7 @@
         if [ "${SPACKAGES}" = "" ]; then
             Display --indent 4 --text "- Query unpurged packages" --result "${STATUS_NONE}" --color GREEN
             LogText "Result: no packages found with left overs"
-          else
+        else
             Display --indent 4 --text "- Query unpurged packages" --result "${STATUS_FOUND}" --color YELLOW
             LogText "Result: found one or more packages with left over configuration files, cron jobs etc"
             LogText "Output:"
@@ -420,7 +418,7 @@
             done
             ReportSuggestion ${TEST_NO} "Purge old/removed packages (${N} found) with aptitude purge or dpkg --purge command. This will cleanup old configuration files, cron jobs and startup scripts."
         fi
-      else
+    else
         LogText "Result: dpkg can NOT be found on this system, test skipped"
     fi
 #
@@ -438,7 +436,7 @@
             if [ ${FIND} -eq 0 ]; then
                 Display --indent 2 --text "- Checking presence old distfiles" --result "${STATUS_OK}" --color GREEN
                 LogText "Result: no unused distfiles found"
-              else
+            else
                 Display --indent 2 --text "- Checking presence old distfiles" --result "${STATUS_WARNING}" --color YELLOW
                 LogText "Result: found ${FIND} unused distfiles"
                 ReportSuggestion ${TEST_NO} "Unused distfiles found. Use portsclean to delete these files. For example: portsclean -DD."
@@ -492,7 +490,7 @@
             ReportWarning ${TEST_NO} "Found one or more vulnerable packages. Run: dnf upgrade"
             Display --indent 2 --text "- Using DNF to find vulnerable packages" --result "${STATUS_WARNING}" --color RED
 
-          else
+        else
             LogText "Result: no security updates found"
             Display --indent 2 --text "- Using DNF to find vulnerable packages" --result "${STATUS_NONE}" --color GREEN
             AddHP 5 5
@@ -508,7 +506,7 @@
         FIND=`${DNFBINARY} 2>&1 | ${GREPBINARY} "^repoquery"`
         if [ ! "${FIND}" = "" ]; then
             LogText "Action: checking integrity of package database"
-            FIND=`${DNFBINARY} -q repoquery --duplicated`
+            FIND=$(${DNFBINARY} -q repoquery --duplicated)
             if [ ! "${FIND}" = "" ]; then
                 LogText "Result: found unexpected result on repoquery --duplicated"
                 ReportSuggestion "${TEST_NO}" "Check output of: dnf repoquery --duplicated"
@@ -518,7 +516,7 @@
                 LogText "Result: found unexpected result on repoquery --unsatisfied"
                 ReportSuggestion "${TEST_NO}" "Check output of: dnf repoquery --unsatisfied"
             fi
-          else
+        else
             LogText "Result: repoquery plugin not installed."
         fi
     fi
@@ -536,18 +534,18 @@
             AddHP 3 3
             PACKAGE_AUDIT_TOOL_FOUND=1
             PACKAGE_AUDIT_TOOL="debsecan"
-            FIND=`find /etc/cron* -name debsecan`
+            FIND=$(${FINDBINARY} ${ROOTDIR}etc/cron* -name debsecan)
             if [ ! ${FIND} = "" ]; then
                 LogText "Result: cron job is configured for debsecan"
                 Display --indent 6 --text "- debsecan cron job" --result "${STATUS_FOUND}" --color GREEN
                 AddHP 3 3
-              else
+            else
                 LogText "Result: no cron job is configured for debsecan"
                 Display --indent 4 --text "- debsecan cron job" --result "${STATUS_NOT_FOUND}" --color YELLOW
                 AddHP 1 3
                 ReportSuggestion ${TEST_NO} "Check debsecan cron job and ensure it is enabled"
             fi
-          else
+        else
             LogText "Result: debsecan is not installed."
             Display --indent 4 --text "- debsecan utility" --result "${STATUS_NOT_FOUND}" --color YELLOW
             AddHP 0 2
@@ -573,13 +571,13 @@
                 LogText "Result: Cron job is configured for debsums utility."
                 Display --indent 6 --text "- Cron job for debsums" --result "${STATUS_FOUND}" --color GREEN
                 AddHP 3 3
-              else
+            else
                 LogText "Result: Cron job is not configured for debsums utility."
                 Display --indent 6 --text "- Cron job for debsums" --result "${STATUS_NOT_FOUND}" --color YELLOW
                 AddHP 1 3
                 ReportSuggestion "${TEST_NO}" "Check debsums configuration and enable checking regurlarly via a cron job."
             fi
-          else
+        else
             LogText "Result: debsums utility is not installed."
             AddHP 0 2
             ReportSuggestion ${TEST_NO} "Install debsums utility for the verification of packages with known good database."
@@ -624,8 +622,8 @@
                 if [ "${FIND}" = "" ]; then
                     LogText "Result: pkg audit results are clean"
                     Display --indent 2 --text "- Checking pkg_admin audit to obtain vulnerable packages" --result "${STATUS_NONE}" --color GREEN
-                    AddHP 2 2
-                  else
+                    AddHP 10 10
+                else
                     Display --indent 2 --text "- Checking pkg_admin audit to obtain vulnerable packages" --result "${STATUS_WARNING}" --color RED
                     LogText "Result: pkg_admin audit found one or more installed packages which are vulnerable."
                     ReportWarning ${TEST_NO} "Found one or more vulnerable packages."
@@ -638,12 +636,11 @@
                         AddHP 1 2
                     done
                 fi
-              else
+            else
                 ReportSuggestion "${TEST_NO}" "Fetch the package database with pkg_admin fetch-pkg-vulnerabilities"
                 AddHP 0 2
-
             fi
-          else
+        else
             Display --indent 2 --text "- pkg_admin audit not installed" --result "${STATUS_NOT_FOUND}" --color WHITE
             LogText "Result: pkg_admin audit not installed, skipping this vulnerability test."
         fi
@@ -664,6 +661,7 @@
         if [ $? -eq 0 ]; then
             LogText "Result: pkg audit results are clean"
             Display --indent 2 --text "- Checking pkg audit to obtain vulnerable packages" --result "${STATUS_NONE}" --color GREEN
+            AddHP 10 10
         else
             if [ ! -z "${FIND}" ]; then
                 VULNERABLE_PACKAGES_FOUND=1
@@ -689,25 +687,26 @@
     if [ -x /usr/local/sbin/portaudit ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7382 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for vulnerable FreeBSD packages with portaudit"
     if [ ${SKIPTEST} -eq 0 ]; then
-            PACKAGE_AUDIT_TOOL_FOUND=1
-            FIND=`/usr/local/sbin/portaudit | ${GREPBINARY} 'problem(s) in your installed packages found' | ${GREPBINARY} -v '0 problem(s) in your installed packages found'`
-            if [ "${FIND}" = "" ]; then
-                LogText "Result: Portaudit results are clean"
-                Display --indent 2 --text "- Checking portaudit to obtain vulnerable packages" --result "${STATUS_NONE}" --color GREEN
-              else
-                Display --indent 2 --text "- Checking portaudit to obtain vulnerabilities" --result "${STATUS_WARNING}" --color RED
-                LogText "Result: Portaudit found one or more installed packages which are vulnerable."
-                ReportWarning ${TEST_NO} "Found one or more vulnerable packages."
-                ReportSuggestion ${TEST_NO} "Update your system with portupgrade or other tools"
-                LogText "List of vulnerable packages/version:"
-                for I in `/usr/local/sbin/portaudit | ${GREPBINARY} "Affected package" | ${CUTBINARY} -d ' ' -f3 | ${SORTBINARY} -u`; do
-                    VULNERABLE_PACKAGES_FOUND=1
-                    Report "vulnerable_package[]=${I}"
-                    LogText "Vulnerable package: ${I}"
-                    # Decrease hardening points for every found vulnerable package
-                    AddHP 1 2
-                done
-            fi
+        PACKAGE_AUDIT_TOOL_FOUND=1
+        FIND=`/usr/local/sbin/portaudit | ${GREPBINARY} 'problem(s) in your installed packages found' | ${GREPBINARY} -v '0 problem(s) in your installed packages found'`
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: Portaudit results are clean"
+            Display --indent 2 --text "- Checking portaudit to obtain vulnerable packages" --result "${STATUS_NONE}" --color GREEN
+            AddHP 10 10
+        else
+            Display --indent 2 --text "- Checking portaudit to obtain vulnerabilities" --result "${STATUS_WARNING}" --color RED
+            LogText "Result: Portaudit found one or more installed packages which are vulnerable."
+            ReportWarning ${TEST_NO} "Found one or more vulnerable packages."
+            ReportSuggestion ${TEST_NO} "Update your system with portupgrade or other tools"
+            LogText "List of vulnerable packages/version:"
+            for I in `/usr/local/sbin/portaudit | ${GREPBINARY} "Affected package" | ${CUTBINARY} -d ' ' -f3 | ${SORTBINARY} -u`; do
+                VULNERABLE_PACKAGES_FOUND=1
+                Report "vulnerable_package[]=${I}"
+                LogText "Vulnerable package: ${I}"
+                # Decrease hardening points for every found vulnerable package
+                AddHP 1 2
+            done
+        fi
     fi
 #
 #################################################################################
@@ -745,7 +744,7 @@
             if [ "${FIND}" = "0" ]; then
                 LogText "Result: No duplicate packages found"
                 Display --indent 2 --text "- Checking package database duplicates" --result "${STATUS_OK}" --color GREEN
-              else
+            else
                 LogText "Result: One or more duplicate packages found"
                 Display --indent 2 --text "- Checking package database duplicates" --result "${STATUS_WARNING}" --color RED
                 ReportWarning ${TEST_NO} "Found one or more duplicate packages installed"
@@ -758,13 +757,13 @@
             if [ "${FIND}" = "0" ]; then
                 LogText "Result: No package database problems found"
                 Display --indent 2 --text "- Checking package database for problems" --result "${STATUS_OK}" --color GREEN
-              else
+            else
                 LogText "Result: One or more problems found in package database"
                 Display --indent 2 --text "- Checking package database for problems" --result "${STATUS_WARNING}" --color RED
                 ReportWarning ${TEST_NO} "Found one or more problems in the package database"
                 ReportSuggestion ${TEST_NO} "Run package-cleanup to solve package problems"
             fi
-          else
+        else
             Display --indent 2 --text "- yum-utils package not installed" --result "${STATUS_SUGGESTION}" --color YELLOW
             LogText "Result: YUM utils package not found"
             ReportSuggestion ${TEST_NO} "Install package 'yum-utils' for better consistency checking of the package database"
@@ -790,25 +789,25 @@
             FileExists /usr/share/yum-cli/cli.py
             if [ ${FILE_FOUND} -eq 1 ]; then
                SearchItem "\-\-security" "/usr/share/yum-cli/cli.py"
-               if [ ${ITEM_FOUND} -eq 1 ]; then
-                   DO_TEST=1
-                   LogText "Result: found built-in security in yum"
-                 else
-                   LogText "Result: did not find --security in /usr/share/yum-cli/cli.py"
-               fi
+                if [ ${ITEM_FOUND} -eq 1 ]; then
+                    DO_TEST=1
+                    LogText "Result: found built-in security in yum"
+                else
+                    LogText "Result: did not find --security in /usr/share/yum-cli/cli.py"
+                fi
             fi
         fi
 
         if [ ${DO_TEST} -eq 0 ]; then
             FileExists /etc/yum/pluginconf.d/security.conf
             if [ ${FILE_FOUND} -eq 1 ]; then
-               SearchItem "^enabled=1$" "/etc/yum/pluginconf.d/security.conf"
-               if [ ${ITEM_FOUND} -eq 1 ]; then
-                   DO_TEST=1
-                   LogText "Result: found enabled plugin"
-                 else
-                   LogText "Result: plugin NOT enabled in /etc/yum/pluginconf.d/security.conf"
-               fi
+                SearchItem "^enabled=1$" "/etc/yum/pluginconf.d/security.conf"
+                if [ ${ITEM_FOUND} -eq 1 ]; then
+                    DO_TEST=1
+                    LogText "Result: found enabled plugin"
+                else
+                    LogText "Result: plugin NOT enabled in /etc/yum/pluginconf.d/security.conf"
+                fi
             fi
         fi
 
@@ -830,7 +829,7 @@
             if [ "${FIND2}" = "" ]; then
                 LogText "Result: no vulnerable packages found"
                 Display --indent 2 --text "- Checking missing security packages" --result "${STATUS_OK}" --color GREEN
-              else
+            else
                 LogText "Result: found vulnerable package(s)"
                 Display --indent 2 --text "- Checking missing security packages" --result "${STATUS_WARNING}" --color RED
                 for I in ${FIND2}; do
@@ -842,7 +841,7 @@
                 ReportWarning ${TEST_NO} "Found one or more vulnerable packages."
                 ReportSuggestion ${TEST_NO} "Use 'yum --security update' to update your system"
             fi
-          else
+        else
             LogText "Result: yum-security package not found"
             Display --indent 2 --text "- Checking missing security packages" --result "${STATUS_SKIPPED}" --color YELLOW
             ReportSuggestion ${TEST_NO} "Install package yum-plugin-security if possible, to maintain security updates easier (yum install yum-plugin-security)"
@@ -859,17 +858,17 @@
         FOUND=0
         FileExists /etc/yum.conf
         if [ ${FILE_FOUND} -eq 1 ]; then
-           SearchItem "^gpgenabled\s*=\s*1$" "/etc/yum.conf"; if [ ${ITEM_FOUND} -eq 1 ]; then FOUND=1; fi
-           SearchItem "^gpgcheck\s*=\s*1$" "/etc/yum.conf"; if [ ${ITEM_FOUND} -eq 1 ]; then FOUND=1; fi
-           if [ ${FOUND} -eq 1 ]; then
-               LogText "Result: GPG check is enabled"
-               Display --indent 2 --text "- Checking GPG checks (yum.conf)" --result "${STATUS_OK}" --color GREEN
-             else
-               Display --indent 2 --text "- Checking GPG checks (yum.conf)" --result "${STATUS_DISABLED}" --color RED
-               ReportWarning ${TEST_NO} "No GPG signing option found in yum.conf"
-           fi
+            SearchItem "^gpgenabled\s*=\s*1$" "/etc/yum.conf"; if [ ${ITEM_FOUND} -eq 1 ]; then FOUND=1; fi
+            SearchItem "^gpgcheck\s*=\s*1$" "/etc/yum.conf"; if [ ${ITEM_FOUND} -eq 1 ]; then FOUND=1; fi
+            if [ ${FOUND} -eq 1 ]; then
+                LogText "Result: GPG check is enabled"
+                Display --indent 2 --text "- Checking GPG checks (yum.conf)" --result "${STATUS_OK}" --color GREEN
+            else
+                Display --indent 2 --text "- Checking GPG checks (yum.conf)" --result "${STATUS_DISABLED}" --color RED
+                ReportWarning ${TEST_NO} "No GPG signing option found in yum.conf"
+            fi
         fi
-     fi
+    fi
 #
 #################################################################################
 #
@@ -932,7 +931,7 @@
         if [ "${FIND}" = "0" ]; then
             Display --indent 2 --text "- Checking APT package database" --result "${STATUS_OK}" --color GREEN
             LogText "Result: package database seems to be consistent."
-          else
+        else
             LogText "Result: package database is most likely NOT consistent"
             Display --indent 2 --text "- Checking APT package database" --result "${STATUS_WARNING}" --color RED
             ReportWarning ${TEST_NO} "apt-get check returned a non successful exit code."
@@ -959,34 +958,34 @@
         LogText "Result: apt-get finished"
         LogText "Test: Checking if /usr/lib/update-notifier/apt-check exists"
         if [ -x /usr/lib/update-notifier/apt-check ]; then
-          PACKAGE_AUDIT_TOOL="apt-check"
-          LogText "Result: found /usr/lib/update-notifier/apt-check"
-          LogText "Test: checking if any of the updates contain security updates"
-          # apt-check binary is a script and translated. Do not search for normal text strings, but use numbered output only
-          FIND=`/usr/lib/update-notifier/apt-check 2>&1 | ${AWKBINARY} -F\; '{ print $2 }'`
-          # Check if we get the proper line back and amount of security patches available
-          if [ "${FIND}" = "" ]; then
-              LogText "Result: did not find security updates line"
-              ReportSuggestion ${TEST_NO} "Check if system is up-to-date, security updates test (apt-check) gives an unexpected result"
-              ReportException "${TEST_NO}:1" "Apt-check did not provide any result"
+            PACKAGE_AUDIT_TOOL="apt-check"
+            LogText "Result: found /usr/lib/update-notifier/apt-check"
+            LogText "Test: checking if any of the updates contain security updates"
+            # apt-check binary is a script and translated. Do not search for normal text strings, but use numbered output only
+            FIND=$(/usr/lib/update-notifier/apt-check 2>&1 | ${AWKBINARY} -F\; '{ print $2 }')
+            # Check if we get the proper line back and amount of security patches available
+            if [ -z "${FIND}" ]; then
+                LogText "Result: did not find security updates line"
+                ReportSuggestion ${TEST_NO} "Check if system is up-to-date, security updates test (apt-check) gives an unexpected result"
+                ReportException "${TEST_NO}:1" "Apt-check did not provide any result"
             else
-              if [ "${FIND}" = "0" ]; then
-                  LogText "Result: no vulnerable packages found via apt-check"
-                  SCAN_PERFORMED=1
+                if [ "${FIND}" = "0" ]; then
+                    LogText "Result: no vulnerable packages found via apt-check"
+                    SCAN_PERFORMED=1
                 else
-                  VULNERABLE_PACKAGES_FOUND=1
-                  SCAN_PERFORMED=1
-                  LogText "Result: found ${FIND} security updates via apt-check"
-                  AddHP 0 25
-              fi
-          fi
-          else
+                    VULNERABLE_PACKAGES_FOUND=1
+                    SCAN_PERFORMED=1
+                    LogText "Result: found ${FIND} security updates via apt-check"
+                    AddHP 0 25
+                fi
+            fi
+        else
             LogText "Result: apt-check (update-notifier-common) not found"
         fi
 
         # Trying also with apt-get directly (does not always work, as updates are distributed on both -security and -updates)
         # Show packages which would be upgraded and match 'security' in repository name
-        FIND=`/usr/bin/apt-get --dry-run --show-upgraded upgrade 2> /dev/null | ${GREPBINARY} '-security' | ${GREPBINARY} "^Inst" | ${CUTBINARY} -d ' ' -f2 | ${SORTBINARY} -u`
+        FIND=$(/usr/bin/apt-get --dry-run --show-upgraded upgrade 2> /dev/null | ${GREPBINARY} '-security' | ${GREPBINARY} "^Inst" | ${CUTBINARY} -d ' ' -f2 | ${SORTBINARY} -u)
         if [ ! "${FIND}" = "" ]; then
             VULNERABLE_PACKAGES_FOUND=1
             SCAN_PERFORMED=1
@@ -1003,11 +1002,11 @@
                 ReportWarning ${TEST_NO} "Found one or more vulnerable packages."
                 ReportSuggestion ${TEST_NO} "Update your system with apt-get update, apt-get upgrade, apt-get dist-upgrade and/or unattended-upgrades"
                 Display --indent 2 --text "- Checking vulnerable packages" --result "${STATUS_WARNING}" --color RED
-              else
+            else
                 Display --indent 2 --text "- Checking vulnerable packages" --result "${STATUS_OK}" --color GREEN
                 LogText "Result: no vulnerable packages found"
             fi
-          else
+        else
             Display --indent 2 --text "- Checking vulnerable packages (apt-get only)" --result "${STATUS_DONE}" --color GREEN
             LogText "Result: test not fully executed (missing apt-check output)"
         fi
@@ -1040,16 +1039,16 @@
             LogText "Result: found /usr/bin/glsa-check"
             LogText "Test: checking if there are any vulnerable packages"
             # glsa-check reports the GLSA date/ID string, not the vulnerable package.
-            FIND=`/usr/bin/glsa-check -t all 2>&1 | ${GREPBINARY} -v "This system is affected by the following GLSAs:" | ${GREPBINARY} -v "This system is not affected by any of the listed GLSAs" | wc -l`
-            if [ "${FIND}" = "" ]; then
+            FIND=$(/usr/bin/glsa-check -t all 2>&1 | ${GREPBINARY} -v "This system is affected by the following GLSAs:" | ${GREPBINARY} -v "This system is not affected by any of the listed GLSAs" | ${WCBINARY} -l)
+            if [ -z "${FIND}" ]; then
                 LogText "Result: unexpected result: wc should report 0 if no vulnerable packages are found."
                 LogText "Notes: Check if system is up-to-date, security updates check (glsa-check) gives and unexpected result"
                 ReportException "${TEST_NO}:1" "glsa-check did not provide any result, which is unexpected"
-              else
+            else
                 if [ "${FIND}" = "0" ]; then
                     LogText "Result; no vulnerable packages found via glsa-check"
                     Display --indent 2 --text "- Checking vulnerable packages (glsa-check)" --result "${STATUS_OK}" --color GREEN
-                  else
+                else
                     VULNERABLE_PACKAGES_FOUND=1
                     Display --indent 2 --text "- Checking vulnerable packages (glsa-check)" --result "${STATUS_FOUND}" --color RED
                     LogText "Result: found ${FIND} security updates with glsa-check"
@@ -1075,18 +1074,18 @@
         if [ -x /usr/bin/apt-show-versions ]; then
             LogText "Result: found /usr/bin/apt-show-versions"
             LogText "Test: Checking packages which can be upgraded via apt-show-versions"
-            FIND=`/usr/bin/apt-show-versions -u | ${SEDBINARY} 's/ /!space!/g'`
-            if [ "${FIND}" = "" ]; then
+            FIND=$(/usr/bin/apt-show-versions -u | ${SEDBINARY} 's/ /!space!/g')
+            if [ -z "${FIND}" ]; then
                 LogText "Result: no packages found which can be upgraded"
                 Display --indent 2 --text "- Checking upgradeable packages" --result "${STATUS_NONE}" --color GREEN
                 AddHP 3 3
-              else
+            else
                 LogText "Result: found one or more packages which can be upgraded"
                 Display --indent 2 --text "- Checking upgradeable packages" --result "${STATUS_FOUND}" --color YELLOW
                 # output: program/repository upgradeable from version X to Y
-                for I in ${FIND}; do
-                    I=`echo ${I} | ${SEDBINARY} 's/!space!/ /g'`
-                    LogText "${I}"
+                for ITEM in ${FIND}; do
+                    ITEM=$(echo ${ITEM} | ${SEDBINARY} 's/!space!/ /g')
+                    LogText "${ITEM}"
                 done
             fi
           else
@@ -1132,9 +1131,9 @@
     Register --test-no PKGS-7410 --weight L --network NO --category security --description "Count installed kernel packages"
     if [ ${SKIPTEST} -eq 0 ]; then
         KERNELS=0
-        if [ ! "${RPMBINARY}" = "" ]; then
+        if [ ! -z "${RPMBINARY}" ]; then
             LogText "Test: Checking how many kernel packages are installed"
-            KERNELS=`rpm -q kernel 2> /dev/null | wc -l`
+            KERNELS=$(${RPMBINARY} -q kernel 2> /dev/null | ${WCBINARY} -l)
             if [ ${KERNELS} -eq 0 ]; then
                 LogText "Result: found no kernels from rpm -q kernel output, which is unexpected"
                 ReportException "KRNL-5840:1" "Could not find any kernel packages from RPM output"
@@ -1162,7 +1161,6 @@ Report "vulnerable_packages_found=${VULNERABLE_PACKAGES_FOUND}"
 
 WaitForKeyPress
 
-
 #
 #================================================================================
 # Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com