Mirrors/linux-baseline
2
0
Fork 0
mirror of https://github.com/dev-sec/linux-baseline synced 2025-02-03 20:53:25 +00:00
Code Issues Projects Releases Packages Wiki Activity

fix intendation

Browse source
This commit is contained in:
Edmund Haselwanter 2014-05-27 09:39:33 +02:00
parent 15a15678ee
commit 742a544754
3 changed files with 132 additions and 139 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

250
default/serverspec/sysctl_spec.rb
View file

@ -1,188 +1,186 @@
require 'spec_helper'
RSpec.configure do |c|
c.filter_run_excluding :skipOn => backend(Serverspec::Commands::Base).check_os[:family]
c.filter_run_excluding skipOn: backend(Serverspec::Commands::Base).check_os[:family]
end
describe 'IP V4 networking' do
context linux_kernel_parameter('net.ipv4.ip_forward') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.ip_forward') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.all.forwarding') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.all.forwarding') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.all.rp_filter') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.conf.all.rp_filter') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.conf.default.rp_filter') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.conf.default.rp_filter') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.icmp_ignore_bogus_error_responses') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.icmp_ignore_bogus_error_responses') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.icmp_ratelimit') do
its(:value) { should eq 100 }
end
context linux_kernel_parameter('net.ipv4.icmp_ratelimit') do
its(:value) { should eq 100 }
end
context linux_kernel_parameter('net.ipv4.icmp_ratemask') do
its(:value) { should eq 88089 }
end
context linux_kernel_parameter('net.ipv4.icmp_ratemask') do
its(:value) { should eq 88089 }
end
context linux_kernel_parameter('net.ipv4.tcp_timestamps') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.tcp_timestamps') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.all.arp_ignore') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.conf.all.arp_ignore') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.conf.all.arp_announce') do
its(:value) { should eq 2 }
end
context linux_kernel_parameter('net.ipv4.conf.all.arp_announce') do
its(:value) { should eq 2 }
end
context linux_kernel_parameter('net.ipv4.tcp_rfc1337') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.tcp_rfc1337') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.tcp_syncookies') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.tcp_syncookies') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.conf.all.shared_media') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.conf.all.shared_media') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.conf.default.shared_media') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.conf.default.shared_media') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv4.conf.all.accept_source_route') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.all.accept_source_route') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.default.accept_source_route') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.default.accept_source_route') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.default.accept_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.default.accept_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.all.accept_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.all.accept_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.all.secure_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.all.secure_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.default.secure_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.default.secure_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.all.send_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.all.send_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.all.send_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv4.conf.all.send_redirects') do
its(:value) { should eq 0 }
end
# log_martians can cause a denial of service attack to the host
context linux_kernel_parameter('net.ipv4.conf.all.log_martians') do
its(:value) { should eq 0 }
end
# log_martians can cause a denial of service attack to the host
context linux_kernel_parameter('net.ipv4.conf.all.log_martians') do
its(:value) { should eq 0 }
end
end
describe 'IP V6 Networking' do
context linux_kernel_parameter('net.ipv6.conf.all.disable_ipv6') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv6.conf.all.disable_ipv6') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv6.conf.all.forwarding') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.all.forwarding') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.accept_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.accept_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.all.accept_redirects') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.all.accept_redirects') do
its(:value) { should eq 0 }
end
end
describe 'NSA 2.5.3.2.5 Limit Network-Transmitted Configuration' do
context linux_kernel_parameter('net.ipv6.conf.default.router_solicitations') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.router_solicitations') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.accept_ra_rtr_pref') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.accept_ra_rtr_pref') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.accept_ra_pinfo') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.accept_ra_pinfo') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.accept_ra_defrtr') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.accept_ra_defrtr') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.autoconf') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.autoconf') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.dad_transmits') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.dad_transmits') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('net.ipv6.conf.default.max_addresses') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('net.ipv6.conf.default.max_addresses') do
its(:value) { should eq 1 }
end
end
describe 'System sysctl' do
context linux_kernel_parameter('kernel.modules_disabled') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('kernel.modules_disabled') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('kernel.sysrq') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('kernel.sysrq') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('fs.suid_dumpable') do
its(:value) { should eq 0 }
end
context linux_kernel_parameter('fs.suid_dumpable') do
its(:value) { should eq 0 }
end
end
describe 'ExecShield' do
%x( cat /proc/cpuinfo | egrep "^flags" | grep -q ' nx ' )
if ($?.exitstatus != 0)
context linux_kernel_parameter('kernel.exec-shield') do
its(:value) { should eq 1 }
end
%x( cat /proc/cpuinfo | egrep "^flags" | grep -q ' nx ' )
if $CHILD_STATUS.exitstatus != 0
context linux_kernel_parameter('kernel.exec-shield') do
its(:value) { should eq 1 }
end
end
context linux_kernel_parameter('kernel.randomize_va_space') do
its(:value) { should eq 2 }
end
context linux_kernel_parameter('kernel.randomize_va_space') do
its(:value) { should eq 2 }
end
end

15
modules_disabled/serverspec/modules_spec.rb
View file

@ -1,15 +1,10 @@
require 'spec_helper'
describe 'preloaded modules' do
describe file('/etc/initramfs-tools/modules') do
before do
if (RSpec.configuration.os[:family] != 'Debian')
pending "initramfs creation not ported to this platform yet"
end
end
its(:content) { should match /^ghash-clmulni-intel/ }
its(:content) { should match /^aesni-intel/ }
its(:content) { should match /^kvm-intel/ }
describe file('/etc/initramfs-tools/modules') do
before do
if RSpec.configuration.os[:family] != 'Debian'
pending 'initramfs creation not ported to this platform yet'
end
end
end

6
modules_disabled/serverspec/sysctl_spec.rb
View file

@ -2,8 +2,8 @@ require 'spec_helper'
describe 'System sysctl' do
context linux_kernel_parameter('kernel.modules_disabled') do
its(:value) { should eq 1 }
end
context linux_kernel_parameter('kernel.modules_disabled') do
its(:value) { should eq 1 }
end
end