51 lines
1.8 KiB
Django/Jinja
51 lines
1.8 KiB
Django/Jinja
#!/bin/bash
|
|
# CIS Ubuntu 24.04 - 6.1.4.1 Ensure access to all logfiles has been configured.
|
|
# Adaptation simplifiee du script officiel CIS pour Ubuntu (retire les cas RHEL/SSSD/gdm
|
|
# non pertinents ici). Ne fait que RESTREINDRE les permissions, jamais les elargir.
|
|
|
|
set -u
|
|
|
|
fix_file() {
|
|
local f="$1" perm_mask="$2" rperms="$3" auser="$4" agroup="$5"
|
|
local mode user group
|
|
read -r mode user group < <(stat -Lc '%#a %U %G' "$f" 2>/dev/null)
|
|
[ -z "${mode:-}" ] && return
|
|
if [ $(( mode & perm_mask )) -gt 0 ]; then
|
|
chmod "$rperms" "$f"
|
|
fi
|
|
if [[ ! "$user" =~ ^($auser)$ ]]; then
|
|
chown root "$f"
|
|
fi
|
|
if [[ ! "$group" =~ ^($agroup)$ ]]; then
|
|
chgrp root "$f"
|
|
fi
|
|
}
|
|
|
|
while IFS= read -r -d '' file; do
|
|
base="$(basename "$file")"
|
|
dir="$(dirname "$file")"
|
|
case "$base" in
|
|
lastlog|lastlog.*|wtmp|wtmp.*|wtmp-*|btmp|btmp.*|btmp-*)
|
|
# group-write tolere : necessaire au bon fonctionnement de last/who/lastlog
|
|
# (groupe utmp) — plus strict casserait ces commandes, ecart assume vs le
|
|
# check SCA generique qui ne distingue pas ces fichiers.
|
|
fix_file "$file" 0113 "ug-x,o-wx" "root" "root|utmp"
|
|
;;
|
|
README)
|
|
fix_file "$file" 0137 "u-x,g-wx,o-rwx" "root" "root|adm"
|
|
;;
|
|
*.journal|*.journal~)
|
|
fix_file "$file" 0137 "u-x,g-wx,o-rwx" "root" "root|systemd-journal"
|
|
;;
|
|
*)
|
|
if [[ "$dir" == *"/apt" ]]; then
|
|
fix_file "$file" 0137 "u-x,g-wx,o-rwx" "root" "root|adm"
|
|
else
|
|
fix_file "$file" 0137 "u-x,g-wx,o-rwx" "root|syslog" "root|adm"
|
|
fi
|
|
;;
|
|
esac
|
|
done < <(find -L /var/log -type f \( -perm /0137 -o ! -user root -o ! -group root \) -print0 2>/dev/null)
|
|
|
|
echo "OK"
|