CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 17:52:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update features check

Browse Source 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
This commit is contained in:
reyesj2
2024-01-18 16:06:53 -05:00
parent 65d46ea27d
commit caf4036dbf
1 changed files with 33 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
salt/common/tools/sbin/so-common-status-check
View File

@@ -38,49 +38,39 @@ def check_needs_restarted():
f.write(val) f.write(val)
def check_for_fips(): def check_for_fips():
os = __grains__['os'] fips = 0
fips = False try:
# Only checking fully supported OS result = subprocess.run(['fips-mode-setup', '--is-enabled'], check=True, stdout=subprocess.PIPE)
if os == 'OEL': fips = int(result.returncode == 0)
try: except FileNotFoundError:
result = subprocess.run(['fips-mode-setup', '--is-enabled'], check=True, stdout=subprocess.PIPE) with open('/proc/sys/crypto/fips_enabled', 'r') as f:
fips = result.returncode == 0 contents = f.read()
except FileNotFoundError: if '1' in contents:
with open('/proc/sys/crypto/fips_enabled', 'r') as f: fips = 1
contents = f.read() else:
if '1' in contents: fips = 0
fips = True with open('/opt/so/log/sostatus/fips_enabled', 'w') as f:
else: f.write(str(fips))
fips = False
return fips
def check_for_luks(): def check_for_luks():
os = __grains__['os'] luks = 0
luks = False result = subprocess.run(['lsblk', '-p', '-J'], check=True, stdout=subprocess.PIPE)
# Only checking fully supported OS data = json.loads(result.stdout)
if os == 'OEL': for device in data['blockdevices']:
result = subprocess.run(['lsblk', '-p', '-J'], check=True, stdout=subprocess.PIPE) if 'children' in device:
data = json.loads(result.stdout) for gc in device['children']:
for device in data['blockdevices']: if 'children' in gc:
if 'children' in device: try:
for gc in device['children']: result = subprocess.run(['cryptsetup', 'isLuks', gc['name']], check=True, stdout=subprocess.PIPE)
if 'children' in gc: luks = int(result.returncode == 0)
try: except FileNotFoundError:
result = subprocess.run(['cryptsetup', 'isLuks', gc['name']], check=True, stdout=subprocess.PIPE) for ggc in gc['children']:
luks = result.returncode == 0 if 'crypt' in ggc['type']:
except FileNotFoundError: luks = 1
for ggc in gc['children']: if luks:
if 'crypt' in ggc['type']: break
luks = True with open('/opt/so/log/sostatus/luks_enabled', 'w') as f:
if luks: f.write(str(luks))
break
return luks
def check_features():
fips = check_for_fips()
luks = check_for_luks()
with open('/opt/so/log/sostatus/features-check.log', 'w') as f:
f.write("featuresdetected fips={},luks={}".format(fips,luks))
def fail(msg): def fail(msg):
print(msg, file=sys.stderr) print(msg, file=sys.stderr)
@@ -92,7 +82,8 @@ def main():
fail("This program must be run as root") fail("This program must be run as root")
check_needs_restarted() check_needs_restarted()
check_features() check_for_fips()
check_for_luks()
if __name__ == "__main__": if __name__ == "__main__":
main() main()