deb.hardn.sh

#!/bin/bash
# deb.hardn.sh
#
# Build-time hardening for the HARDN-XDR container image.
# Runs inside the container as root during the Docker build
# (RUN /usr/local/bin/deb.hardn.sh).
#
# Scope: container-internal only. No writes to the host kernel, Docker daemon,
# or any socket. Operations that only make sense on the host (AppArmor module
# loading, SELinux context setting, docker-daemon.json edits) are intentionally
# left to the runtime/orchestration layer (--security-opt, compose).
#
# This script only does work whose result is verifiable in the final image:
#   1. CIS 1.7  - login / MOTD warning banners
#   2. STIG     - shell session inactivity timeout (TMOUT)
#   3. real sha256 file-integrity baseline used by health_check.sh / smoke_test.sh
#
# It does NOT pretend to run ClamAV, rkhunter, tripwire, AIDE or OpenSCAP: those
# tools are not installed in the hardened image (they pull in Python/perl/sqlite
# and their own CVE surface). STIG scanning is performed in CI against the built
# image (see .github/workflows/docker-publish.yml), not faked here.

set -euo pipefail
IFS=$'\n\t'

export DEBIAN_FRONTEND=noninteractive

# Path is read by health_check.sh and smoke_test.sh. It lives directly under
# /opt/hardn-xdr (read-only rootfs at runtime) rather than /var/lib/hardn, which
# docker-compose masks with a tmpfs mount.
INTEGRITY_DB="/opt/hardn-xdr/file-integrity.db"

degraded=0
note() { printf '[hardn] %s\n' "$*"; }
mark_degraded() { printf '[hardn][DEGRADED] %s\n' "$*" >&2; degraded=1; }

###############################################################################
# Pre-flight
###############################################################################

if [[ $EUID -ne 0 ]]; then
    echo "This script must run as root — hardening requires elevated privileges." >&2
    exit 1
fi

if [[ -f /.dockerenv ]] || grep -qE 'docker|container' /proc/1/cgroup 2>/dev/null; then
    note "container environment detected — host-level operations skipped by design"
fi

echo "---------------------------------------------"
echo " HARDN-XDR container hardening"
echo "---------------------------------------------"

###############################################################################
# CIS 1.7 — warning banners (real files, verified by smoke_test.sh)
###############################################################################

BANNER='AUTHORIZED ACCESS ONLY. All activity may be monitored and recorded. Unauthorized use is prohibited and may be prosecuted.'
for f in /etc/issue /etc/issue.net /etc/motd; do
    printf '%s\n' "$BANNER" > "$f" && chmod 0644 "$f" \
        && note "banner written: $f" \
        || mark_degraded "could not write banner: $f"
done

###############################################################################
# STIG — shell session inactivity timeout
###############################################################################

if [[ -f /etc/profile ]]; then
    if ! grep -q 'TMOUT=900' /etc/profile; then
        printf '\n# HARDN-XDR: STIG session inactivity timeout\nreadonly TMOUT=900\nexport TMOUT\n' >> /etc/profile
    fi
    note "session timeout (TMOUT=900) configured in /etc/profile"
else
    mark_degraded "/etc/profile missing — cannot set session timeout"
fi

###############################################################################
# File-integrity baseline — a genuine sha256 manifest of the image's critical
# binaries and config. This is the artifact health_check.sh and smoke_test.sh
# assert on, so it must actually exist and be non-empty.
###############################################################################

note "building file-integrity baseline at ${INTEGRITY_DB} ..."
mkdir -p "$(dirname "$INTEGRITY_DB")"
{
    printf '# HARDN-XDR file-integrity baseline\n'
    printf '# format: <sha256>  <path>\n'
    find /usr/local/bin /usr/local/sbin /usr/bin /usr/sbin /bin /sbin \
         /etc/ssl /etc/pam.d /etc/security /etc/sysctl.d \
         -xdev -type f 2>/dev/null \
      | sort \
      | while IFS= read -r path; do
            [[ -r "$path" ]] && sha256sum "$path" 2>/dev/null || true
        done
} > "$INTEGRITY_DB"

# root-owned, world-readable, not writable by the non-root runtime user
chown root:root "$INTEGRITY_DB" 2>/dev/null || true
chmod 0444 "$INTEGRITY_DB" 2>/dev/null || true

entries="$(grep -c '^[0-9a-f]\{64\}' "$INTEGRITY_DB" 2>/dev/null || echo 0)"
if [[ "$entries" -gt 0 ]]; then
    note "file-integrity baseline created (${entries} files hashed)"
else
    mark_degraded "file-integrity baseline is empty — hashing produced no entries"
fi

# Protect this script from modification by the non-root runtime user
chmod 700 "${BASH_SOURCE[0]}" 2>/dev/null || true

###############################################################################
# Summary
###############################################################################

echo "---------------------------------------------"
if [[ "$degraded" -eq 0 ]]; then
    echo " HARDN-XDR hardening complete"
    echo "---------------------------------------------"
    exit 0
else
    echo " HARDN-XDR hardening DEGRADED — see [DEGRADED] lines above" >&2
    echo "---------------------------------------------"
    exit 1
fi