Skip to content

Commit 51bc582

Browse files
damcav35Damien Cavagnini
damcav35
and
Damien Cavagnini
authored
refactor: is_kernel_option_enabled (#267)
Current "is_kernel_option_enabled" function is doing many things, like checking for a kernel option AND checking a kernel module state AND checking if it is disabled We split it in different functions: - is_kernel_monolithic - is_kernel_option_enabled -> check for a kernel configuration in the running kernel - is_kernel_module_loaded -> check if a module is currently loaded - is_kernel_module_available -> check if a module is configured in all available kernel configs - is_kernel_module_disabled -> check if a kernel module is disabled in the modprobe configuration Also: - update its behaviour to debian 12 CIS recommendation, to check if a module is "available in ANY installed kernel" - fix "disable_usb_storage" to look for correct module name once loaded : issue #249 - the associated checks now check separately if the module is loaded, and if it is configured - for checks about kernel module presence, the "apply" function now manages to disable the module in the modprobe configuration (if kernel not monolithic) (but still wont unload it) Co-authored-by: Damien Cavagnini <damien.cavagnini@corp.ovh.com>
1 parent ab0dba9 commit 51bc582

13 files changed

+447
-178
lines changed

‎bin/hardening/disable_cramfs.sh‎

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,25 @@ audit() {
2626
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
2727
ok "Container detected, consider host enforcing or disable this check!"
2828
else
29-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
30-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
31-
crit "$MODULE_NAME is enabled!"
29+
is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
30+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
31+
crit "$MODULE_NAME is loaded!"
3232
else
33-
ok "$MODULE_NAME is disabled"
33+
ok "$MODULE_NAME is not loaded"
34+
fi
35+
36+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
37+
is_kernel_module_disabled "$MODULE_NAME"
38+
if [ "$FNRET" -eq 0 ]; then
39+
ok "$MODULE_NAME is disabled in the modprobe configuration"
40+
else
41+
is_kernel_module_available "$KERNEL_OPTION"
42+
if [ "$FNRET" -eq 0 ]; then
43+
crit "$MODULE_NAME is available in some kernel config, but not disabled"
44+
else
45+
ok "$MODULE_NAME is not available in any kernel config"
46+
fi
47+
fi
3448
fi
3549
fi
3650
}
@@ -41,11 +55,18 @@ apply() {
4155
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
4256
ok "Container detected, consider host enforcing!"
4357
else
44-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
45-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
46-
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
47-
else
48-
ok "$MODULE_NAME is disabled"
58+
is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
59+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
60+
crit "$LOADED_MODULE_NAME is loaded!"
61+
warn "I wont unload the module, unload it manually or recompile the kernel if needed"
62+
fi
63+
64+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
65+
is_kernel_module_disabled "$MODULE_NAME"
66+
if [ "$FNRET" -eq 1 ]; then
67+
echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
68+
info "$MODULE_NAME has been disabled in the modprobe configuration"
69+
fi
4970
fi
5071
fi
5172
}

‎bin/hardening/disable_dccp.sh‎

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,25 @@ audit() {
2828
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
2929
ok "Container detected, consider host enforcing or disable this check!"
3030
else
31-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
32-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
33-
crit "$MODULE_NAME is enabled!"
31+
is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
32+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
33+
crit "$MODULE_NAME is loaded!"
3434
else
35-
ok "$MODULE_NAME is disabled"
35+
ok "$MODULE_NAME is not loaded"
36+
fi
37+
38+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
39+
is_kernel_module_disabled "$MODULE_NAME"
40+
if [ "$FNRET" -eq 0 ]; then
41+
ok "$MODULE_NAME is disabled in the modprobe configuration"
42+
else
43+
is_kernel_module_available "$KERNEL_OPTION"
44+
if [ "$FNRET" -eq 0 ]; then
45+
crit "$MODULE_NAME is available in some kernel config, but not disabled"
46+
else
47+
ok "$MODULE_NAME is not available in any kernel config"
48+
fi
49+
fi
3650
fi
3751
fi
3852
}
@@ -43,11 +57,18 @@ apply() {
4357
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
4458
ok "Container detected, consider host enforcing!"
4559
else
46-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
47-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
48-
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
49-
else
50-
ok "$MODULE_NAME is disabled"
60+
is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
61+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
62+
crit "$LOADED_MODULE_NAME is loaded!"
63+
warn "I wont unload the module, unload it manually or recompile the kernel if needed"
64+
fi
65+
66+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
67+
is_kernel_module_disabled "$MODULE_NAME"
68+
if [ "$FNRET" -eq 1 ]; then
69+
echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
70+
info "$MODULE_NAME has been disabled in the modprobe configuration"
71+
fi
5172
fi
5273
fi
5374
}

‎bin/hardening/disable_freevxfs.sh‎

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,25 @@ audit() {
2626
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
2727
ok "Container detected, consider host enforcing or disable this check!"
2828
else
29-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
30-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
31-
crit "$MODULE_NAME is enabled!"
29+
is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
30+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
31+
crit "$MODULE_NAME is loaded!"
3232
else
33-
ok "$MODULE_NAME is disabled"
33+
ok "$MODULE_NAME is not loaded"
34+
fi
35+
36+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
37+
is_kernel_module_disabled "$MODULE_NAME"
38+
if [ "$FNRET" -eq 0 ]; then
39+
ok "$MODULE_NAME is disabled in the modprobe configuration"
40+
else
41+
is_kernel_module_available "$KERNEL_OPTION"
42+
if [ "$FNRET" -eq 0 ]; then
43+
crit "$MODULE_NAME is available in some kernel config, but not disabled"
44+
else
45+
ok "$MODULE_NAME is not available in any kernel config"
46+
fi
47+
fi
3448
fi
3549
fi
3650
}
@@ -41,11 +55,18 @@ apply() {
4155
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
4256
ok "Container detected, consider host enforcing!"
4357
else
44-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
45-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
46-
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
47-
else
48-
ok "$MODULE_NAME is disabled"
58+
is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
59+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
60+
crit "$LOADED_MODULE_NAME is loaded!"
61+
warn "I wont unload the module, unload it manually or recompile the kernel if needed"
62+
fi
63+
64+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
65+
is_kernel_module_disabled "$MODULE_NAME"
66+
if [ "$FNRET" -eq 1 ]; then
67+
echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
68+
info "$MODULE_NAME has been disabled in the modprobe configuration"
69+
fi
4970
fi
5071
fi
5172
}

‎bin/hardening/disable_hfs.sh‎

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,25 @@ audit() {
2626
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
2727
ok "Container detected, consider host enforcing or disable this check!"
2828
else
29-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
30-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
31-
crit "$MODULE_NAME is enabled!"
29+
is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
30+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
31+
crit "$MODULE_NAME is loaded!"
3232
else
33-
ok "$MODULE_NAME is disabled"
33+
ok "$MODULE_NAME is not loaded"
34+
fi
35+
36+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
37+
is_kernel_module_disabled "$MODULE_NAME"
38+
if [ "$FNRET" -eq 0 ]; then
39+
ok "$MODULE_NAME is disabled in the modprobe configuration"
40+
else
41+
is_kernel_module_available "$KERNEL_OPTION"
42+
if [ "$FNRET" -eq 0 ]; then
43+
crit "$MODULE_NAME is available in some kernel config, but not disabled"
44+
else
45+
ok "$MODULE_NAME is not available in any kernel config"
46+
fi
47+
fi
3448
fi
3549
fi
3650
}
@@ -41,11 +55,18 @@ apply() {
4155
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
4256
ok "Container detected, consider host enforcing!"
4357
else
44-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
45-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
46-
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
47-
else
48-
ok "$MODULE_NAME is disabled"
58+
is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
59+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
60+
crit "$LOADED_MODULE_NAME is loaded!"
61+
warn "I wont unload the module, unload it manually or recompile the kernel if needed"
62+
fi
63+
64+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
65+
is_kernel_module_disabled "$MODULE_NAME"
66+
if [ "$FNRET" -eq 1 ]; then
67+
echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
68+
info "$MODULE_NAME has been disabled in the modprobe configuration"
69+
fi
4970
fi
5071
fi
5172
}

‎bin/hardening/disable_hfsplus.sh‎

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,25 @@ audit() {
2626
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
2727
ok "Container detected, consider host enforcing or disable this check!"
2828
else
29-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
30-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
31-
crit "$MODULE_NAME is enabled!"
29+
is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
30+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
31+
crit "$MODULE_NAME is loaded!"
3232
else
33-
ok "$MODULE_NAME is disabled"
33+
ok "$MODULE_NAME is not loaded"
34+
fi
35+
36+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
37+
is_kernel_module_disabled "$MODULE_NAME"
38+
if [ "$FNRET" -eq 0 ]; then
39+
ok "$MODULE_NAME is disabled in the modprobe configuration"
40+
else
41+
is_kernel_module_available "$KERNEL_OPTION"
42+
if [ "$FNRET" -eq 0 ]; then
43+
crit "$MODULE_NAME is available in some kernel config, but not disabled"
44+
else
45+
ok "$MODULE_NAME is not available in any kernel config"
46+
fi
47+
fi
3448
fi
3549
fi
3650
}
@@ -41,11 +55,18 @@ apply() {
4155
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
4256
ok "Container detected, consider host enforcing!"
4357
else
44-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
45-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
46-
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
47-
else
48-
ok "$MODULE_NAME is disabled"
58+
is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
59+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
60+
crit "$LOADED_MODULE_NAME is loaded!"
61+
warn "I wont unload the module, unload it manually or recompile the kernel if needed"
62+
fi
63+
64+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
65+
is_kernel_module_disabled "$MODULE_NAME"
66+
if [ "$FNRET" -eq 1 ]; then
67+
echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
68+
info "$MODULE_NAME has been disabled in the modprobe configuration"
69+
fi
4970
fi
5071
fi
5172
}

‎bin/hardening/disable_jffs2.sh‎

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,25 @@ audit() {
2626
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
2727
ok "Container detected, consider host enforcing or disable this check!"
2828
else
29-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
30-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
31-
crit "$MODULE_NAME is enabled!"
29+
is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
30+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
31+
crit "$MODULE_NAME is loaded!"
3232
else
33-
ok "$MODULE_NAME is disabled"
33+
ok "$MODULE_NAME is not loaded"
34+
fi
35+
36+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
37+
is_kernel_module_disabled "$MODULE_NAME"
38+
if [ "$FNRET" -eq 0 ]; then
39+
ok "$MODULE_NAME is disabled in the modprobe configuration"
40+
else
41+
is_kernel_module_available "$KERNEL_OPTION"
42+
if [ "$FNRET" -eq 0 ]; then
43+
crit "$MODULE_NAME is available in some kernel config, but not disabled"
44+
else
45+
ok "$MODULE_NAME is not available in any kernel config"
46+
fi
47+
fi
3448
fi
3549
fi
3650
}
@@ -41,11 +55,18 @@ apply() {
4155
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
4256
ok "Container detected, consider host enforcing!"
4357
else
44-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
45-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
46-
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
47-
else
48-
ok "$MODULE_NAME is disabled"
58+
is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
59+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
60+
crit "$LOADED_MODULE_NAME is loaded!"
61+
warn "I wont unload the module, unload it manually or recompile the kernel if needed"
62+
fi
63+
64+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
65+
is_kernel_module_disabled "$MODULE_NAME"
66+
if [ "$FNRET" -eq 1 ]; then
67+
echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
68+
info "$MODULE_NAME has been disabled in the modprobe configuration"
69+
fi
4970
fi
5071
fi
5172
}

‎bin/hardening/disable_rds.sh‎

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,25 @@ audit() {
2828
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
2929
ok "Container detected, consider host enforcing or disable this check!"
3030
else
31-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
32-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
33-
crit "$MODULE_NAME is enabled!"
31+
is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
32+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
33+
crit "$MODULE_NAME is loaded!"
3434
else
35-
ok "$MODULE_NAME is disabled"
35+
ok "$MODULE_NAME is not loaded"
36+
fi
37+
38+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
39+
is_kernel_module_disabled "$MODULE_NAME"
40+
if [ "$FNRET" -eq 0 ]; then
41+
ok "$MODULE_NAME is disabled in the modprobe configuration"
42+
else
43+
is_kernel_module_available "$KERNEL_OPTION"
44+
if [ "$FNRET" -eq 0 ]; then
45+
crit "$MODULE_NAME is available in some kernel config, but not disabled"
46+
else
47+
ok "$MODULE_NAME is not available in any kernel config"
48+
fi
49+
fi
3650
fi
3751
fi
3852
}
@@ -43,11 +57,18 @@ apply() {
4357
# In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
4458
ok "Container detected, consider host enforcing!"
4559
else
46-
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
47-
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
48-
warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
49-
else
50-
ok "$MODULE_NAME is disabled"
60+
is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
61+
if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
62+
crit "$LOADED_MODULE_NAME is loaded!"
63+
warn "I wont unload the module, unload it manually or recompile the kernel if needed"
64+
fi
65+
66+
if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
67+
is_kernel_module_disabled "$MODULE_NAME"
68+
if [ "$FNRET" -eq 1 ]; then
69+
echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
70+
info "$MODULE_NAME has been disabled in the modprobe configuration"
71+
fi
5172
fi
5273
fi
5374
}

0 commit comments

Comments
 (0)