Mirrors/linux-baseline
2
0
Fork 0
mirror of https://github.com/dev-sec/linux-baseline synced 2024-11-10 05:34:14 +00:00
Code Issues Projects Releases Packages Wiki Activity
381 commits 17 branches 31 tags 478 KiB
Commit graph

381 commits

This branch
This branch
All branches
Author SHA1 Message Date
dev-sec CI
4a44c941db update inspec.yml and changelog 2024-08-21 07:50:33 +00:00
schurzi
9805ec5d07
Repair release workflow 2024-08-21 09:49:23 +02:00
schurzi
d06e065952
Use current source for CINC packages 2024-08-21 09:37:12 +02:00
dev-sec CI
0adb7a2c57 update inspec.yml and changelog 2023-11-19 15:51:11 +00:00
schurzi
1b2026ff42
Merge pull request #184 from dev-sec/inspec6 
ensure compatibility with new inspec version
 2023-11-19 16:50:04 +01:00
Martin Schurz
19825b5565 fix formating 
Signed-off-by: Martin Schurz <Martin.Schurz@telekom.de>
 2023-11-19 16:49:11 +01:00
Martin Schurz
ba94b91d38 add all inputs 
Signed-off-by: Martin Schurz <Martin.Schurz@telekom.de>
 2023-11-19 01:12:44 +01:00
Martin Schurz
d079b4a57f use only metadata 
Signed-off-by: Martin Schurz <Martin.Schurz@telekom.de>
 2023-11-19 01:08:45 +01:00
Martin Schurz
b850f351b6 ensure compatibility with new inspec version 
Signed-off-by: Martin Schurz <Martin.Schurz@telekom.de>
 2023-11-18 21:35:28 +01:00
Martin Schurz
11471d5507 ensure compatibility with new inspec version 
Signed-off-by: Martin Schurz <Martin.Schurz@telekom.de>
 2023-11-18 21:27:23 +01:00
dev-sec CI
fe9081f632 update inspec.yml and changelog 2023-05-02 12:53:14 +00:00
schurzi
9d57fead33
Merge pull request #183 from dev-sec/codespell 
add spellchecking with codespell
 2023-05-02 14:51:35 +02:00
Martin Schurz
6cfbd386f0 fix spelling errors 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-04-30 19:11:41 +02:00
Martin Schurz
fe8a9eff9f add codespell action 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-04-30 19:01:33 +02:00
dev-sec CI
ce0e4c6a31 update inspec.yml and changelog 2023-03-31 08:43:53 +00:00
schurzi
7b4d99ac85
Merge pull request #182 from dev-sec/renovate/configure 
Configure Renovate
 2023-03-31 10:42:08 +02:00
Martin Schurz
23c1c028a3 configure renovate 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2023-03-31 10:41:46 +02:00
renovate[bot]
641ad36898
Add renovate.json 2023-03-29 21:44:26 +00:00
dev-sec CI
d962a5de64 update inspec.yml and changelog 2022-12-12 08:42:57 +00:00
schurzi
823e2b9dce
Merge pull request #180 from dev-sec/fix_sysctl_ipv6 
fix wrong sysctl
 2022-12-12 09:41:06 +01:00
Sebastian Gumprich
7a6e7162fe fix wrong sysctl 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2022-12-12 09:13:26 +01:00
dev-sec CI
fcd64d719c update inspec.yml and changelog 2022-11-30 15:18:51 +00:00
schurzi
7075e76ed9
Merge pull request #179 from dev-sec/extend_sysctls 
extend sysctls for ipv6
 2022-11-30 16:17:04 +01:00
Sebastian Gumprich
c15739b961 extend sysctls for ipv6 
see https://docs.vmware.com/en/vRealize-Operations/8.6/com.vmware.vcom.core.doc/GUID-16BDA67D-914A-484C-97CA-8624F4881605.html and https://docs.vmware.com/en/vRealize-Operations/8.6/com.vmware.vcom.core.doc/GUID-37B91C4A-5E1E-4F8E-BC59-B3552BA7CDFA.html

also see https://github.com/dev-sec/ansible-collection-hardening/pull/607/

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2022-11-30 15:21:55 +01:00
dev-sec CI
666e709253 update inspec.yml and changelog 2022-10-28 05:18:33 +00:00
Sebastian Gumprich
ecf5ab6563
Merge pull request #178 from dev-sec/central_workflow 
use centralised issue templates and workflows
 2022-10-28 07:16:53 +02:00
Martin Schurz
4b7d398376 use centralised issue templates and workflows 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2022-10-26 20:18:18 +02:00
dev-sec CI
faa71996fb update inspec.yml and changelog 2022-09-29 07:24:47 +00:00
Sebastian Gumprich
48f72d8c10
Update release.yml 2022-09-29 09:23:02 +02:00
Sebastian Gumprich
7d75f2a0c1
Update release.yml 2022-09-29 09:21:18 +02:00
schurzi
7ce5a1d218
Merge pull request #177 from dev-sec/rndmh3ro-patch-1 
remove entropy-test
 2022-09-24 15:46:05 +02:00
Sebastian Gumprich
a04baec3b3 remove entropy-test 
see https://github.com/dev-sec/linux-baseline/issues/176

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
 2022-09-23 13:10:32 +02:00
schurzi
436bf2f4ae
Merge pull request #175 from dev-sec/ubuntu22 
only disable SquashFS if it's not needed
 2022-08-06 15:55:57 +02:00
Martin Schurz
92cedeb529 only disable SquashFS if it's not needed 
Ubuntu Snaps need SquashFS so we cannot disable it easily. Instead we
check for running Snap Service.

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2022-08-06 15:08:28 +02:00
schurzi
81ce2ab60c
Merge pull request #172 from dev-sec/protected_fifos 
fix handling of sysctl fs.protected_fifos and fs.protected_regular
 2022-07-11 12:17:52 +02:00
Martin Schurz
5247b07871 fix handling of sysctl fs.protected_fifos and fs.protected_regular 
our solution with cmp for fs.protected_fifos did not work. Checking for
all possible values combined with an `or` seems more reasonable here.

Also both sysctl parameters are not available in RHEL7. The chosen
solution seems to be the least complex, that also works on all systems.

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2022-07-11 12:05:53 +02:00
dev-sec CI
34b215b87c update inspec.yml and changelog 2022-03-18 19:46:30 +00:00
schurzi
07929ea2d1
Merge pull request #169 from dev-sec/newlint 
Change linting to Cookstyle
 2022-03-18 20:44:54 +01:00
Martin Schurz
e646854c33 apply cookstyle fixes 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2022-03-18 20:41:09 +01:00
Martin Schurz
b06edb2adc use cookstyle for linting 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
 2022-03-18 20:39:51 +01:00
dev-sec CI
f0084b869f update inspec.yml and changelog 2022-02-14 10:02:12 +00:00
Michée lengronne
f1bff02e51
Merge pull request #168 from magmax/master 
Improve SUID find
 2022-02-14 11:00:03 +01:00
Miguel Angel Garcia
10657ca958 Improve SUID find 
Signed-off-by: Miguel Angel Garcia <miguelangel.garcia@gmail.com>
 2022-02-12 17:38:33 +01:00
dev-sec CI
99a7016135 update inspec.yml and changelog 2022-01-12 17:22:46 +00:00
Michée lengronne
8e3a25a606
Merge pull request #167 from dev-sec/micheelengronne-patch-1 
missing inputs changed
 2022-01-12 18:20:45 +01:00
Michée lengronne
e679f92128 missing inputs changed 
Leftover inputs changed.

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>
 2022-01-12 18:16:37 +01:00
dev-sec CI
4b079b3489 update inspec.yml and changelog 2022-01-12 16:19:03 +00:00
Michée lengronne
b5284b923e
use input instead of attribute (#166) 
* use input instead of attribute

In the last versions of Inspec and cinc-auditor, attribute is deprecated and input should be used.

https://docs.chef.io/workstation/cookstyle/inspec_deprecations_attributehelper/
Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* Update sysctl_spec.rb

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* Update inspec.yml

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* Update Rakefile

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>
 2022-01-12 17:17:16 +01:00
dev-sec CI
fd9581afec update inspec.yml and changelog 2021-11-23 11:07:35 +00:00
Claudius Heine
1840dbb624
feat: add rules to check noexec, nosuid and nodev mount options (#164) 
Setting the `noexec`, `nosuid` and `nodev` mount options for mount
points where those features are not required, limits possible attack
vectors.

Closes: #163

Signed-off-by: Claudius Heine <ch@denx.de>
 2021-11-23 12:04:53 +01:00