!39 fix grub configuration to automatic hardening.
From: @xucee Reviewed-by: @HuaxinLuGitee, @flysubmarine, @zhujianwei001 Signed-off-by: @zhujianwei001
This commit is contained in:
openeuler-ci-bot
Gitee
commit
8df1627e7a
@ -1,4 +1,4 @@
|
||||
From e587488759e5c07058b273dbada7937b96cbc388 Mon Sep 17 00:00:00 2001
|
||||
From a4a86e816552479cb41e3423aef67acc32fb8510 Mon Sep 17 00:00:00 2001
|
||||
From: jinlun <jinlun@huawei.com>
|
||||
Date: Wed, 13 Nov 2024 14:38:36 +0800
|
||||
Subject: [PATCH] Automatic hardening is supported.
|
||||
@ -22,19 +22,20 @@ Signed-off-by: xuce <xuce10@h-partners.com>
|
||||
.../use_pam_wheel_for_su/bash/shared.sh | 2 +-
|
||||
.../bash/shared.sh | 2 +-
|
||||
.../bash/shared.sh | 2 +-
|
||||
.../configure_dump_journald_log/bash/shared.sh | 7 +++++++
|
||||
.../configure_dump_journald_log/bash/shared.sh | 5 +++++
|
||||
.../rsyslog_cron_logging/bash/shared.sh | 4 ++--
|
||||
.../bash/shared.sh | 2 +-
|
||||
.../only_root_can_run_pkexec/bash/shared.sh | 5 +++++
|
||||
.../su/su_always_set_path/bash/shared.sh | 6 ++++++
|
||||
.../sce/openeuler2403.sh | 17 +++++++++++++++++
|
||||
.../bash/shared.sh | 2 +-
|
||||
shared/macros/10-bash.jinja | 10 +++++-----
|
||||
.../grub2_bootloader_argument/bash.template | 2 +-
|
||||
.../bash.template | 2 +-
|
||||
shared/templates/service_disabled/bash.template | 2 +-
|
||||
shared/templates/service_enabled/bash.template | 2 +-
|
||||
shared/templates/sysctl/bash.template | 2 +-
|
||||
28 files changed, 95 insertions(+), 23 deletions(-)
|
||||
29 files changed, 98 insertions(+), 28 deletions(-)
|
||||
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_strong_pubkey/bash/shared.sh
|
||||
create mode 100644 linux_os/guide/system/accounts/accounts-pam/no_name_contained_in_password/bash/shared.sh
|
||||
create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/bash/shared.sh
|
||||
@ -170,7 +171,7 @@ index 3a32aad..2b0f4b4 100644
|
||||
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/no_name_contained_in_password/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/no_name_contained_in_password/bash/shared.sh
|
||||
new file mode 100644
|
||||
index 0000000..797f631
|
||||
index 0000000..568f4f5
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/no_name_contained_in_password/bash/shared.sh
|
||||
@@ -0,0 +1,11 @@
|
||||
@ -187,7 +188,7 @@ index 0000000..797f631
|
||||
+fi
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/bash/shared.sh
|
||||
new file mode 100644
|
||||
index 0000000..9f3f5df
|
||||
index 0000000..7795559
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/bash/shared.sh
|
||||
@@ -0,0 +1,10 @@
|
||||
@ -215,7 +216,7 @@ index 6e47912..107ef85 100644
|
||||
|
||||
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/gid_passwd_group_same/bash/shared.sh b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/gid_passwd_group_same/bash/shared.sh
|
||||
new file mode 100644
|
||||
index 0000000..badcc54
|
||||
index 0000000..7f1cd3a
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/gid_passwd_group_same/bash/shared.sh
|
||||
@@ -0,0 +1,10 @@
|
||||
@ -261,7 +262,7 @@ index 5007f96..1834f35 100644
|
||||
|
||||
diff --git a/linux_os/guide/system/logging/configure_dump_journald_log/bash/shared.sh b/linux_os/guide/system/logging/configure_dump_journald_log/bash/shared.sh
|
||||
new file mode 100644
|
||||
index 0000000..7b8d8aa
|
||||
index 0000000..12febfb
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/logging/configure_dump_journald_log/bash/shared.sh
|
||||
@@ -0,0 +1,5 @@
|
||||
@ -308,7 +309,7 @@ index 0000000..1057e81
|
||||
+});" > /etc/polkit-1/rules.d/50-default.rules
|
||||
diff --git a/linux_os/guide/system/software/su/su_always_set_path/bash/shared.sh b/linux_os/guide/system/software/su/su_always_set_path/bash/shared.sh
|
||||
new file mode 100644
|
||||
index 0000000..4ac660f
|
||||
index 0000000..a5e4058
|
||||
--- /dev/null
|
||||
+++ b/linux_os/guide/system/software/su/su_always_set_path/bash/shared.sh
|
||||
@@ -0,0 +1,6 @@
|
||||
@ -351,6 +352,41 @@ index 07e02fa..1a47c35 100644
|
||||
{{% if product in ["sle12", "sle15"] %}}
|
||||
sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/zypp/repos.d/*
|
||||
{{% else %}}
|
||||
diff --git a/shared/macros/10-bash.jinja b/shared/macros/10-bash.jinja
|
||||
index 292a14a..9a8eace 100644
|
||||
--- a/shared/macros/10-bash.jinja
|
||||
+++ b/shared/macros/10-bash.jinja
|
||||
@@ -1980,7 +1980,7 @@ Part of the grub2_bootloader_argument template.
|
||||
|
||||
#}}
|
||||
{{% macro grub2_bootloader_argument_remediation(arg_name, arg_name_value) %}}
|
||||
-{{% if 'ubuntu' in product or product in ['rhel7', 'ol7', 'sle12', 'sle15'] %}}
|
||||
+{{% if 'ubuntu' in product or 'openeuler' in product or product in ['rhel7', 'ol7', 'sle12', 'sle15'] %}}
|
||||
{{{ update_etc_default_grub_manually(arg_name, arg_name_value) }}}
|
||||
{{% endif -%}}
|
||||
{{{ grub_command("add", arg_name_value) }}}
|
||||
@@ -1996,9 +1996,9 @@ Part of the grub2_bootloader_argument template.
|
||||
#}}
|
||||
{{%- macro update_etc_default_grub_manually_absent(arg_name) -%}}
|
||||
# Correct the form of default kernel command line in GRUB
|
||||
-if grep -q '^GRUB_CMDLINE_LINUX=.*{{{ arg_name }}}=.*"' '/etc/default/grub' ; then
|
||||
- sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\){{{ arg_name }}}=?[^[:space:]]*\(.*"\)/\1 \2/' '/etc/default/grub'
|
||||
-fi
|
||||
+while grep -q '^GRUB_CMDLINE_LINUX=.*{{{ arg_name }}}=.*"' '/etc/default/grub' ; do
|
||||
+ sed -i 's/\(^GRUB_CMDLINE_LINUX=".*[[:space:]]\?\){{{ arg_name }}}=\?[^[:space:]]*[[:space:]]\?\(.*"\)/\1\2/' '/etc/default/grub'
|
||||
+done
|
||||
{{%- endmacro %}}
|
||||
|
||||
|
||||
@@ -2011,7 +2011,7 @@ Part of the grub2_bootloader_argument_absent template.
|
||||
|
||||
#}}
|
||||
{{% macro grub2_bootloader_argument_absent_remediation(arg_name) %}}
|
||||
-{{% if 'ubuntu' in product or product in ['rhel7', 'ol7', 'sle12', 'sle15'] %}}
|
||||
+{{% if 'ubuntu' in product or 'openeuler' in product or product in ['rhel7', 'ol7', 'sle12', 'sle15'] %}}
|
||||
{{{ update_etc_default_grub_manually_absent(arg_name) }}}
|
||||
{{% endif -%}}
|
||||
{{{ grub_command("remove", arg_name) }}}
|
||||
diff --git a/shared/templates/grub2_bootloader_argument/bash.template b/shared/templates/grub2_bootloader_argument/bash.template
|
||||
index 965f4d3..4cbedf3 100644
|
||||
--- a/shared/templates/grub2_bootloader_argument/bash.template
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
Name: scap-security-guide
|
||||
Version: 0.1.68
|
||||
Release: 5
|
||||
Release: 6
|
||||
Summary: Security guidance and baselines in SCAP formats
|
||||
License: BSD-3-Clause
|
||||
URL: https://github.com/ComplianceAsCode/content/
|
||||
@ -65,6 +65,9 @@ cd build
|
||||
%doc %{_docdir}/%{name}/tables/*.html
|
||||
|
||||
%changelog
|
||||
* Fri Nov 15 2024 jinlun <jinlun@huawei.com> - 0.1.68-6
|
||||
- fix openeuler grub configuration to Automatic hardening.
|
||||
|
||||
* Wed Nov 13 2024 jinlun <jinlun@huawei.com> - 0.1.68-5
|
||||
- Automatic hardening is supported.
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user