Skip to content
This repository was archived by the owner on Jun 6, 2025. It is now read-only.

🧹 Revert the grub audit matchers #191

Merged
atomic111 merged 3 commits into from
Apr 3, 2023
Merged

🧹 Revert the grub audit matchers #191

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d6d3677
Revert the grub audit matchers
micheelengronne Mar 25, 2023
1e2e038
regex pattern added for grub audit
micheelengronne Apr 1, 2023
db6f476
Merge branch 'main' into patch-4
micheelengronne Apr 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions core/mondoo-linux-security.mql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1136,16 +1136,16 @@ queries:
```
query: |
if( file("/boot/grub2/grub.cfg" ).exists) {
file("/boot/grub2/grub.cfg").content.lines.where( _ == /^[^#]/ ).contains("audit\=(\s+)?1")
file("/boot/grub2/grub.cfg").content.contains('audit=1')
Comment thread
atomic111 marked this conversation as resolved.
Outdated
Comment thread
micheelengronne marked this conversation as resolved.
Outdated
}
if( file("/boot/grub/grub.cfg").exists ) {
file("/boot/grub/grub.cfg").content.lines.where( _ == /^[^#]/ ).contains("audit\=(\s+)?1")
file("/boot/grub/grub.cfg").content.contains('audit=1')
Comment thread
atomic111 marked this conversation as resolved.
Outdated
Comment thread
micheelengronne marked this conversation as resolved.
Outdated
}
if( file("/boot/grub/grub.conf").exists ) {
file("/boot/grub/grub.conf").content.lines.where( _ == /^[^#]/ ).contains("audit\=(\s+)?1")
file("/boot/grub/grub.conf").content.contains('audit=1')
Comment thread
atomic111 marked this conversation as resolved.
Outdated
Comment thread
micheelengronne marked this conversation as resolved.
Outdated
}
if( file('/etc/secboot/config.json').exists ) {
parse.json('/etc/secboot/config.json').params['kernel-params'].contains('audit\=(\s+)?1')
parse.json('/etc/secboot/config.json').params['kernel-params'].contains('audit=1')
Comment thread
micheelengronne marked this conversation as resolved.
Outdated
}
- uid: mondoo-linux-security-audit-log-storage-size-is-configured
title: Ensure audit log storage size is configured
Expand Down
⚡