diff options
| author | mboelen <michael@cisofy.com> | 2016-04-13 17:13:04 +0300 |
|---|---|---|
| committer | mboelen <michael@cisofy.com> | 2016-04-13 17:13:04 +0300 |
| commit | 9a0102384f2326687d1ae6fb04a03d3b47991547 (patch) | |
| tree | 1068a6943d497144793077a3e7ee27e1736fd395 /include/tests_kernel_hardening | |
| parent | fdd20a324e7c8f07cbd8b20b1a2f0d5805357dac (diff) | |
[KRNL-6000] Change test to allow parsing multiple profiles and storing more details
Diffstat (limited to 'include/tests_kernel_hardening')
| -rw-r--r-- | include/tests_kernel_hardening | 46 |
1 files changed, 26 insertions, 20 deletions
diff --git a/include/tests_kernel_hardening b/include/tests_kernel_hardening index 9eef2d48..41e4a968 100644 --- a/include/tests_kernel_hardening +++ b/include/tests_kernel_hardening @@ -32,33 +32,39 @@ if [ ! "${SYSCTL_READKEY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no KRNL-6000 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check sysctl key pairs in scan profile" if [ ${SKIPTEST} -eq 0 ]; then + FOUND=0 N=0 Display --indent 2 --text "- Comparing sysctl key pairs with scan profile" - FIND=`grep "^sysctl:" ${PROFILE} | sed 's/ /:space:/g'` - for I in ${FIND}; do - tFINDkey=`echo ${I} | awk -F: '{ print $2 }'` - tFINDexpvalue=`echo ${I} | awk -F: '{ print $3 }'` - tFINDhp=`echo ${I} | awk -F: '{ print $4 }' | grep "[0-9]"` - tFINDdesc=`echo ${I} | awk -F: '{ print $5 }' | sed 's/:space:/ /g'` - tFINDcurvalue=`${SYSCTL_READKEY} ${tFINDkey} 2> /dev/null` - if [ ! "${tFINDcurvalue}" = "" ]; then - if [ "${tFINDexpvalue}" = "${tFINDcurvalue}" ]; then - LogText "Result: sysctl key ${tFINDkey} contains equal expected and current value (${tFINDexpvalue})" - Display --indent 4 --text "- ${tFINDkey} (exp: ${tFINDexpvalue})" --result OK --color GREEN - AddHP ${tFINDhp} ${tFINDhp} + for PROFILE in ${PROFILES}; do + FIND=`grep "^sysctl:" ${PROFILE} | sed 's/ /-space-/g'` + for I in ${FIND}; do + tFINDkey=`echo ${I} | awk -F: '{ print $2 }'` + tFINDexpvalue=`echo ${I} | awk -F: '{ print $3 }'` + tFINDhp=`echo ${I} | awk -F: '{ print $4 }' | grep "[0-9]"` + tFINDdesc=`echo ${I} | awk -F: '{ print $5 }' | sed 's/-space-/ /g'` + tFINDcurvalue=`${SYSCTL_READKEY} ${tFINDkey} 2> /dev/null` + if [ ! "${tFINDcurvalue}" = "" ]; then + if [ "${tFINDexpvalue}" = "${tFINDcurvalue}" ]; then + LogText "Result: sysctl key ${tFINDkey} contains equal expected and current value (${tFINDexpvalue})" + Display --indent 4 --text "- ${tFINDkey} (exp: ${tFINDexpvalue})" --result OK --color GREEN + AddHP ${tFINDhp} ${tFINDhp} + else + LogText "Result: sysctl key ${tFINDkey} has a different value than expected in scan profile. Expected=${tFINDexpvalue}, Real=${tFINDcurvalue}" + Display --indent 4 --text "- ${tFINDkey} (exp: ${tFINDexpvalue})" --result DIFFERENT --color RED + AddHP 0 ${tFINDhp} + FOUND=1 + N=`expr ${N} + 1` + ReportDetails --test "${TEST_NO}" --key "-" --field "${tFINDkey}" --value "${tFINDcurvalue}" --preferredvalue "${tFINDexpvalue}" --description "${tFINDdesc}" + fi else - LogText "Result: sysctl key ${tFINDkey} has a different value than expected in scan profile. Expected=${tFINDexpvalue}, Real=${tFINDcurvalue}" - Display --indent 4 --text "- ${tFINDkey} (exp: ${tFINDexpvalue})" --result DIFFERENT --color RED - AddHP 0 ${tFINDhp} - N=1 + LogText "Result: key ${tFINDkey} does not exist on this machine" fi - else - LogText "Result: key ${tFINDkey} does not exist on this machine" - fi + done done # Add suggestion if one or more sysctls have a different value than scan profile - if [ ${N} -eq 1 ]; then + if [ ${FOUND} -eq 1 ]; then + LogText "Result: found ${N} keys that can use tuning, according scan profile" ReportSuggestion ${TEST_NO} "One or more sysctl values differ from the scan profile and could be tweaked" fi fi |