[FILE-6430] - Wrong tests and logic on ubuntu

[SixK]

In https://github.com/CISOfy/lynis/blob/d76bfdbc1c47c3ffe4faa8cdaae70cc56fad0ad9/include/tests_filesystems#L849 tests and logic for FILE-6430 seem's wrong.

Version

• Distribution [Ubuntu 22.04]
• Lynis version [master]

Expected behavior Lynis should not attribute points to loaded modules

Verify test case load hfs module using sudo insmod /lib/modules/6.8.0-48-generic/kernel/fs/hfs/hfs.ko or sudo modprobe hfs
verify hfs module is loaded

lsmod | grep hfs
> hfs                    77824  0

run lynis filesystems tests sudo lynis --tests-from-group filesystems --verbose --debug|grep hfs

sudo lynis --tests-from-group filesystems --verbose --debug|grep hfs
      - Module hfs not present in the kernel                  [ OK ]
[DEBUG] Module hfsplus present in the kernel
      - Module hfsplus not loaded (lsmod)                     [ OK ]
      - Module squashfs not present in the kernel             [ OK ]

Lynis return that hfs is not present in the kernel, while module is loaded and test get 3 points attributed.

test could be simplified as this:

FIND=$(modprobe -v -n hfs 2>/dev/null | grep -E "/hfs.ko" | tail -1)
if [ -n "${FIND}" ]; then
    echo "module loaded";
else
    echo "module not loaded";
fi

this return module not loaded, because modprobe return nothing when module is already loaded.

Fact is that test can't differenciates if module exists and is loaded and if module is not supported by kernel. If testing an unexisting module, we have the same return:

FIND=$(modprobe -v -n hfszzz 2>/dev/null | grep -E "/hfszzz.ko" | tail -1)
if [ -n "${FIND}" ]; then
    echo "module loaded";
else
    echo "module not loaded";
fi

this return module not loaded too.

I would suggest to rather test something like command value returned:

• modprobe -v -n hfs;echo $? return 0 value
• modprobe -v -n hfszz;echo $? return 1 value

In this case, code could be modified with something like this:

FIND=$(modprobe -v -n hfsplus 2>/dev/null)
if [ $? -eq 0 ]; then    
    echo "module loaded";
else
    echo "module not loaded";
fi

Then line LogText "Result: found ${FS} support in the kernel (output = ${FIND})" would return (output = ) if module is loaded and if module is not loaded (output = insmod /lib/modules/6.8.0-48-generic/kernel/fs/hfs/hfs.ko)