search

ovh / debian-cis

PCI-DSS compliant Debian 10/11/12 hardening
Other
757 stars 130 forks source link

Fix empty fstab test #134

Closed tdenof closed 2 years ago

tdenof commented 2 years ago

The test was checking if fstab is not empty, so we were always falling back on /proc/mounts Before

hardening                 [INFO] Treating /opt/cis-hardening/bin/hardening/1.1.14_home_nodev.sh
hardening                 [DBG ] /opt/cis-hardening/bin/hardening//opt/cis-hardening/bin/hardening/1.1.14_home_nodev.sh --audit --sudo 
1.1.14_home_nodev         [DBG ] Audit argument detected, setting status to audit
1.1.14_home_nodev         [DBG ] Unknown option passed
1.1.14_home_nodev         [INFO] Working on 1.1.14_home_nodev
1.1.14_home_nodev         [INFO] [DESCRIPTION] /home partition with nodev option.
1.1.14_home_nodev         [DBG ] Audit argument detected, setting status to audit
1.1.14_home_nodev         [INFO] Checking Configuration
1.1.14_home_nodev         [INFO] Performing audit
1.1.14_home_nodev         [INFO] Verifying that /home is a partition
1.1.14_home_nodev         [DBG ] /etc/fstab not found or empty, searching mountpoint
1.1.14_home_nodev         [ OK ] /home is a partition
1.1.14_home_nodev         [DBG ] /etc/fstab not found or empty, readin current mount options
1.1.14_home_nodev         [DBG ] nodev has been detected in /proc/mounts for partition /home
1.1.14_home_nodev         [ OK ] /home has nodev in fstab
1.1.14_home_nodev         [DBG ] nodev has been detected in /proc/mounts for partition /home
1.1.14_home_nodev         [ OK ] /home mounted with nodev
1.1.14_home_nodev         [ OK ] Check Passed
hardening                 [DBG ] Script /opt/cis-hardening/bin/hardening/1.1.14_home_nodev.sh finished with exit code 0
hardening                 [DBG ] /opt/cis-hardening/bin/hardening/1.1.14_home_nodev.sh passed

After

hardening                 [INFO] Treating /opt/cis-hardening/bin/hardening/1.1.14_home_nodev.sh
hardening                 [DBG ] /opt/cis-hardening/bin/hardening//opt/cis-hardening/bin/hardening/1.1.14_home_nodev.sh --audit --sudo 
1.1.14_home_nodev         [DBG ] Audit argument detected, setting status to audit
1.1.14_home_nodev         [DBG ] Unknown option passed
1.1.14_home_nodev         [INFO] Working on 1.1.14_home_nodev
1.1.14_home_nodev         [INFO] [DESCRIPTION] /home partition with nodev option.
1.1.14_home_nodev         [DBG ] Audit argument detected, setting status to audit
1.1.14_home_nodev         [INFO] Checking Configuration
1.1.14_home_nodev         [INFO] Performing audit
1.1.14_home_nodev         [INFO] Verifying that /home is a partition
1.1.14_home_nodev         [DBG ] /home found in fstab
1.1.14_home_nodev         [ OK ] /home is a partition
1.1.14_home_nodev         [DBG ] nodev has been detected in fstab for partition /home
1.1.14_home_nodev         [ OK ] /home has nodev in fstab
1.1.14_home_nodev         [DBG ] nodev has been detected in /proc/mounts for partition /home
1.1.14_home_nodev         [ OK ] /home mounted with nodev
1.1.14_home_nodev         [ OK ] Check Passed
hardening                 [DBG ] Script /opt/cis-hardening/bin/hardening/1.1.14_home_nodev.sh finished with exit code 0
hardening                 [DBG ] /opt/cis-hardening/bin/hardening/1.1.14_home_nodev.sh passed
tdenof commented 2 years ago

The failing tests should have failed when the fallback on mountpoint (which uses /proc/self/mountinfo) was introduced, but due to the -n bug, they were still passing. Fixing

tdenof commented 2 years ago

All tests concerning mountpoints for which retvalshouldbe was set to 1 are now switched to 0 as now we're correctly going through the code calling mountpoint when fstab is empty or doesn't exists. Also removed the dismiss_count_for_test for tests that should pass now.

Other tests were passing, but generating stderr as mountpoint couldn't find some mounpoints (which was the expected behavior), so calling it now with quiet parameter which is enough for the needed test without generating stderr.