Fix 4.1.7 and 4.1.8 audits: test flag from -z to -n

The test flag -z makes the node.yaml checks 4.1.7 and 4.1.8 to fail:

 as -z verifies if $CAFILE is zero instead of nonzero, to enter the first if condition and set CAFILE=$kubeletcafile.

As per test man page:

-n STRING
the length of STRING is nonzero

-z STRING
the length of STRING is zero
pull/1467/head
Andy Pitcher 12 months ago committed by GitHub
parent e2e353a81a
commit 1395c23765
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

@ -98,8 +98,8 @@ groups:
text: "Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)"
audit: |
CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
if test -n "$CAFILE"; then CAFILE=$kubeletcafile; fi
if test -e "$CAFILE"; then stat -c permissions=%a "$CAFILE"; fi
tests:
test_items:
- flag: "permissions"
@ -115,8 +115,8 @@ groups:
text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
audit: |
CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
if test -n "$CAFILE"; then CAFILE=$kubeletcafile; fi
if test -e "$CAFILE"; then stat -c %U:%G "$CAFILE"; fi
tests:
test_items:
- flag: root:root

Loading…
Cancel
Save