#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright 2007-2008, Michael Boelen (michael@rootkit.nl), The Netherlands
# Web site: http://www.rootkit.nl
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Kernel
#
#################################################################################
#
    InsertSection "Kernel"
#
#################################################################################
#
    # Test: check default run level from /etc/inittab
    if [ "${OS}" = "Linux" ]; then
        counttests
        Display --indent 2 --text "- Checking default run level..."
        logtext "Checking default Linux run level... "
	FIND=""
        if [ -f /etc/inittab ]; then FIND=`awk -F: '/^id/ { print $2; }' /etc/inittab | head -n 1`; fi
	# Ubuntu: who -r | tr -s ' ' | cut -d ' ' -f6
	# If output is not "last=", it is default run level
        if [ "${FIND}" = "" ]; then
            Display --indent 6 --text "Result: Unknown run level" --result UNKNOWN --color YELLOW
            logtext "Warning: Can't determine run level from /etc/inittab"
          else
            Display --indent 4 --text "Default level: ${FIND}" --result DONE --color GREEN
            logtext "Found default run level '${FIND}'"
    	    report "linux_default_runlevel=${FIND}"
        fi
	logtextbreak
    fi 

# =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

    if [ "${OS}" = "Linux" ]; then
	counttests    
        Display --indent 2 --text "- Checking CPU support (NX/PAE)"
	logtext "Checking CPU options (NX/PAE)..."
        if [ -f /proc/cpuinfo ]; then
	    FIND=`cat /proc/cpuinfo | grep " pae " | grep " nx "`
	    if [ "${FIND}" = "" ]; then
	        Display --indent 4 --text "CPU does not seem to support PAE or NoExecute" --result NO --color YELLOW
		logtext "Result: PAE or NoExecute option(s) not found"
	      else
	        Display --indent 4 --text "CPU supports PAE and NoExecute" --result YES --color GREEN
		logtext "Result: PAE and NoExecute found."
		logtext "Suggestion: make sure a PAE enabled kernel is used when possible to gain native NX support."
	    fi
	  else
	    Display --indent 4 --text "No CPU information found" --result UNKNOWN --color YELLOW
	    logtext "Result: /proc/cpuinfo not found"
        fi
	
	#YYY Add PAE checks, to see if kernel supports it
        logtextbreak      
    fi

# =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

if [ "${OS}" = "FreeBSD" ]; then
    counttests
    Display --indent 2 --text "- Checking active kernel modules..."
    logtext "Test: ${KERNEL_ACTIVE_MODULES_TITLE}"
    logtext "Description: ${KERNEL_ACTIVE_MODULES_DESCRIPTION}"
    logtext "Action: Checking modules"

    if [ -f /sbin/kldstat ]; then
        FIND=`kldstat | grep -v 'Name' | tr -s ' ' | cut -d ' ' -f6`
        if [ $? -eq 0 ]; then
	    logtext "Loaded modules according kldstat:"
	    N=0
	    for I in ${FIND}; do
    	      logtext "Loaded module: ${I}"
    	      report "loaded_kernel_module[]=${I}"
	      N=$(( $N + 1 ))
	    done
	    Display --indent 4 --text "Found ${N} kernel modules" --result DONE --color GREEN
          else
	    Display --indent 4 --text "Test failed" --result WARNING --color RED
	    logtext "Result: Problem with executing kldstat"
	 fi
      else
        echo "[ ${WHITE}SKIPPED${NORMAL} ]"
        logtext "Result: no results, can't find /sbin/kldstat"
    fi
    logtextbreak
fi

# =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

counttests
logtext "Searching apt-cache, to determine if a newer Debian kernel is available"
if [ -x /usr/bin/apt-cache ]; then
    logtext "Using apt-cache to determine if there is an update available"
    FINDKERNFILE=`readlink -f /vmlinuz`
    FINDKERNEL=`dpkg -S ${FINDKERNFILE} | awk -F : '{print $1}'`
    FINDINST=`apt-cache policy ${FINDKERNEL} | egrep 'Installed' | cut -d ':' -f2 | tr -d ' '`
    FINDCAND=`apt-cache policy ${FINDKERNEL} | egrep 'Candidate' | cut -d ':' -f2 | tr -d ' '`
    logtext "Debian kernel installed: ${FINDINST}"
    logtext "Debian kernel candidate: ${FINDCAND}"
    if [ "${FINDINST}" = "${FINDCAND}" ]; then
        Display --indent 2 --text "- Checking for available kernel update... " --result OK --color GREEN
	logtext "No kernel update available"
      else
        Display --indent 2 --text "- Checking for available kernel update... " --result "UPDATE AVAILABLE" --color YELLOW
	logtext "Warning: kernel update available according 'apt-cache policy'."
    fi
  else
    logtext "apt-cache not found. Debian kernel version check skipped"
fi
logtextbreak


#
#================================================================================
# Lynis - Copyright 2007-2008, Michael Boelen - www.rootkit.nl - The Netherlands
