Mirrors/linux-baseline
2
0
Fork 0
mirror of https://github.com/dev-sec/linux-baseline synced 2024-11-27 05:20:26 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #64 from dev-sec/ap/assignment_re-update

Browse source 
Use assignment_regex, only_if and bump profile version
This commit is contained in:
Christoph Hartmann 2017-05-30 08:11:32 -04:00 committed by GitHub
commit 3a83bad322
3 changed files with 11 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
controls/os_spec.rb
View file

@ -171,7 +171,6 @@ control 'os-05b' do
impact 1.0 impact 1.0
title 'Check login.defs - RedHat specific' title 'Check login.defs - RedHat specific'
desc 'Check owner and permissions for login.defs. Also check the configured PATH variable and umask in login.defs' desc 'Check owner and permissions for login.defs. Also check the configured PATH variable and umask in login.defs'
if os.redhat?
describe file('/etc/login.defs') do describe file('/etc/login.defs') do
it { should_not be_writable } it { should_not be_writable }
end end
@ -181,7 +180,7 @@ control 'os-05b' do
its('SYS_GID_MIN') { should eq '100' } its('SYS_GID_MIN') { should eq '100' }
its('SYS_GID_MAX') { should eq '999' } its('SYS_GID_MAX') { should eq '999' }
end end
end only_if { os.redhat? }
end end
control 'os-06' do control 'os-06' do

2
controls/sysctl_spec.rb
View file

@ -354,7 +354,7 @@ control 'sysctl-33' do
desc 'Kernel features and CPU flags provide a protection against buffer overflows. The CPU NX Flag and the kernel parameter exec-shield prevents code execution on a per memory page basis. If the CPU supports the NX-Flag then this should be used instead of the kernel parameter exec-shield.' desc 'Kernel features and CPU flags provide a protection against buffer overflows. The CPU NX Flag and the kernel parameter exec-shield prevents code execution on a per memory page basis. If the CPU supports the NX-Flag then this should be used instead of the kernel parameter exec-shield.'
# parse for cpu flags # parse for cpu flags
flags = parse_config_file('/proc/cpuinfo', assignment_re: /^([^:]*?)\s+:\s+(.*?)$/).flags flags = parse_config_file('/proc/cpuinfo', assignment_regex: /^([^:]*?)\s+:\s+(.*?)$/).flags
flags ||= '' flags ||= ''
flags = flags.split(' ') flags = flags.split(' ')

2
inspec.yml
View file

@ -5,6 +5,6 @@ copyright: DevSec Hardening Framework Team
copyright_email: hello@dev-sec.io copyright_email: hello@dev-sec.io
license: Apache 2 license license: Apache 2 license
summary: Test-suite for best-preactice Linux OS hardening summary: Test-suite for best-preactice Linux OS hardening
version: 2.1.0 version: 2.1.1
supports: supports:
- os-family: linux - os-family: linux