%define name bclinux-secure-enhancement
%define version 2.3
%define release 7
#%define mybuildroot %{_builddir}/%{name}-%{version}-%{release}.noarch
#%define mybuildroot %{buildroot}/%{name}-%{version}-%{release}.noarch


Summary: System secure check and enhancement tool for BCLinux system
Name: %{name}
Version: %{version}
Release: %{release}%{?dist}
License: GPL
Group: Applications/System
URL: https://github.com/BCLinux/sys-scan-fix-tool
Distribution: openEuler 22.10
Vendor: China Mobile (Suzhou) Software Technology Co., Ltd.
Packager: guzhifeng@cmss.chinamobile.com
Provides: bse


BuildArch: noarch
BuildRoot: %{_builddir}/%{name}-root
#install dependence
Requires: rpmdevtools
Requires: chkrootkit
Source0:%{name}-%{version}.tar.gz


%description
The bse package comes with ABSOLUTELY NO WARRANTY. It's free software,
and you are welcome to redistribute it under the terms of the GNU General
Public License. See the LICENSE file for details about using this software.
This is an auditing tool which tests and gathers (security) information
from Linux based systems. The audience for this tool are security and
system auditors, network specialists and system maintainers, etc.

%prep
%setup -q
#exit 0

%build
exit 0

%install
#install -p -m 755 %{SOURCE0} %{buildroot}
#install -p -m 755 %{_builddir}/%{name}-%{version} %{buildroot}/opt/

mkdir -p %{buildroot}/opt/BCLinux/bse/
cp -a %{_builddir}/%{name}-%{version}/* %{buildroot}/opt/BCLinux/bse/
#keep the bse file in /usr/bin
mkdir -p %{buildroot}/usr/bin
#create symbolic links
ln -snf /opt/BCLinux/bse/bse %{buildroot}/usr/bin/
#create man file
gzip -c %{buildroot}/opt/BCLinux/bse/bse.8 > %{buildroot}/opt/BCLinux/bse/bse.8.gz
mkdir -p %{buildroot}/usr/share/man/man8/
mv %{buildroot}/opt/BCLinux/bse/bse.8.gz %{buildroot}/usr/share/man/man8/
#create bse.conf in /etc/
mkdir -p %{buildroot}/etc
mv %{buildroot}/opt/BCLinux/bse/default.prf %{buildroot}/etc/bse.conf
#record the file and dir properties
mkdir -p %{buildroot}/etc/bse.d/
#exit 0

%post


%clean
[ -d "$RPM_BUILD_ROOT" ] && rm -rf $RPM_BUILD_ROOT
exit 0

%files
%defattr(-,root,root)
/opt/BCLinux/bse
/usr/bin/bse
/usr/share/man/man8/bse.8.gz
/etc/bse.conf
/etc/bse.d


%changelog
*Tue May 23 2023 pengyuan <pengyuan@cmss.chinamobile.com> 2.3-7
- fix service restart problem in check progress 

*Mon Nov 7 2022 pengyuan <pengyuan@cmss.chinamobile.com> 2.3-7
- fix service restart problem

*Mon Aug 8 2022 pengyuan <pengyuan@cmss.chinamobile.com> 2.3-7
- add sshLogFacility in BC-Linux for Euler 22.10
- add ALWAYS SET PATH in BC-Linux for Euler 22.10
- add sshLogLevel in BC-Linux for Euler 22.10
- Modify bse.spec

*Fri Sep 3 2021 Jia Tianzhen <guoyayun@cmss.chinamobile.com> 2.3-6
- Apply to BC-Linux for Euler 21.10
- Modify c06_umask for situations without umask settings  

*Fri Oct 23 2020 Jia Tianzhen <jiatianzhen@cmss.chinamobile.com> 2.3-4
- Add chkrootkit function for bclinux8.1
- modify disable_unused_software in default.prf

*Fri Sep 25 2020 Jia Tianzhen <jiatianzhen@cmss.chinamobile.com> 2.3-3
- Apply to bclinux8.1
- Modify bse.spec for bclinux8.1


*Mon Jun 22 2020 Jia Tianzhen <jiatianzhen@cmss.chinamobile.com> 2.3-2
- Modify s06_umask 

*Thu Feb 13 2020 Jia Tianzhen <jiatianzhen@cmss.chinamobile.com> 2.3-1
- Modify BSE release to 2.3.1.

* Wed Aug 21 2019 Jia Tianzhen <jiatianzhen@cmss.chinamobile.com> 2.2-2
- Modify BSE release to 2.2.2.
- Add the judgment of if the log files exist in restore function.
- Delete extra spaces per line.
- Modify restore adv function in bclinux_common.sh
- Modify c30_softwareBugs about if there is no some softwares.
- Modify s06_umask to simplify the code.
- delete cbc Ciphers algorithm in /etc/ssh/sshd_config.

* Thu Apr 25 2019 Jia Tianzhen <jiatianzhen@cmss.chinamobile.com> 2.2-1
- Modify BSE release to 2.2.1.
- Add chmod 751 section in secure_set/s08_fileProperty.
- Add check /etc/security property section in secure_check/c08_fileProperty.
- Modify loadtext() in include/functions and date in bse.spec.
- Modify TXT_WRN_C08_XX and TXT_SUG_C08_XX in include/TextInfos.xml.
- Mofify s03_passComplex to eliminate the conflict between pam_cracklib.so and pam_pwquality.so.
- Modify restore unused user in bclinux_common.sh
- Modify restore result display in bclinux_common.sh
- Add automatic restart service about bse restore adv.
- Add automatic restart service about bse restore basic.
- Modity set vsftpd security in default.prf.
- Modify disable UnUsed aliases in s27 and c27.
- Modify restore log file property.
- Modify restore function in bclinux_common.sh

* Tue Mar 05 2019 Jia Tianzhen <jiatianzhen@cmss.chinamobile.com> 2.1-9
- Modify release to 9.
- Add password min days and warn age configuration in default.prf.
- Modify set_umask=no in default.prf.
- Add important directory and file permission settings in s08_fileProperty.
- Add important directory and file permission checking in c08_fileProperty.
- Add chmod file and dir in default.prf.
- Create /etc/bse.d in bse.spec.
- Modify directory and file property settings in s08_fileProperty.
- Modify directory and file property checkings in c08_fileProperty.
- Add chmod file and dir default options in include/consts.
- Add chmod file and dir property configuration in include/profile.
- Add WRN_C08_xx description and suggestion in include/Defines_Warning.xml.
- Add TXT_WRN_C08_xx and TXT_SUG_C08_xx in include/TextInfos.xml.
- Add restore property of file and dir in common/bclinux_common.sh.
- Modity bse check rootkit result display in include/report.
- Modify chmod directory and file in /etc/bse.conf and default.prf.
- Add disable_unused_aliases in default.prf.
- Add disable_unused_aliases parameters in include/consts and include/profiles.
- Add s27_disableUnUsedaliases in option_set.
- Add c27_disableUnUsedaliases in option_check.
- Add TXT_SUG_C27 in Defines_Warning.xml.
- Modify /etc/security property in default.prf and include/consts.
- Modify /etc/security property config in include/profiles.

* Thu Jan 03 2019 Jia Tianzhen <jiatianzhen@cmss.chinamobile.com> 2.1-8
- Modify root unlock configuration in s04_loginLock.
- Modify the release to 8 in bse.spec.
- Modify the display result in c41_chkrootkit and bclinux_common.sh.
- Modify PASS_MIN_DAYS and PASS_WARN_AGE set configuration.
- Modify PASS_MIN_DAYS and PASS_WARN_AGE check configuration.
- Add warning name TXT_WRN_C09_xx and suggestion description TXT_SUG_C09_xx to Defines_Warning.xml.

* Wed Nov 21 2018 Jia Tianzhen <jiatianzhen@cmss.chinamobile.com> 2.1-7
- Add bse check rootkit option.
- Add c41_chkrootkit function in intrusion_check.
- Add c41_chkrootkit check result to html report.
- Add Requires chkrootkit and delete temporary files in include/report.
- Modify the html report about rootkit check result.
- Modify the PROGRAM_version to 2.1.7.
- modify the date of version 2.1.6.
- modify bse.spec and bse.
- Modify the rootkit result percentage and 4.1 checking list.
- Modify passwd minclass set check result.
- Modify the OS_ID="BCLinux" and BC-Linux.

* Fri Oct 26 2018 Jia Tianzhen <jiatianzhen@cmss.chinamobile.com> 2.1-6
- Modify the log check result to OK.
- reformat umask setting shell script.
- add set_password_rem prompt in default.prf.
- add root user login lock configuration.
- modify s24_noOneSU to make only wheel gruop users can su to root after fix adv.
- Add:Support password complex setting for el6 system.
- Add: userlist_deny=NO to allow users in the user_list to access the FTP server.

* Tue Jul 24 2018 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 2.1-5
- fix config file in wrong path.
- do proper settings when enhance ssh cipher

* Thu Jun 21 2018 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 2.1-4
- create /etc/bse.conf, bse will find config file in /etc/ and than to install dir.
- use rpmdev-sort to determine whether system has common vulunrabilities.
- search ./default.prf file, in case of run bse in unpack env directely.
- use yum check-update to make bse automatically found update info.
- create symbolic links to /usr/bin/bse, make main file unique.

* Mon Jun 4 2018 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 2.1-3
- add SET_PASS_MIN_LEN=0 in consts file.
- should disable telnet server.
- add check and fix guidance in TextInfos.xml
- add search index in Defines_Warning.xml to supprot c09&s09 checking and setting.
- add bse running parameters, to avoid user wrong settings in default.prf
- Read set_pass_min_len in profile stage.
- add set_pass_min_len configuration in default.prf
- add CVE bug fix action in bse fix module to inform user to fix software CVEs by themslef.
- add system upadte action in bse fix module to inform user to update system by themslef.
- improve output format, to make user easy to understand.
- change "FINISHED" to "OK" with bse check modle.
- improve filter options check code, when BSE disable unused software.
- Get unused sofeware collection for $UNUSED_SOFTWARE_VALUE rather then defined it in modle script.
- Remove c31_passMinlen and move function code to s09 and c09
- if current setting isn't match default.prf config settings, than change.
- minlen is gloable value, so should not use it as local value
- check log file property
- ipfilter mode no need to check if default.prf is exist
- addUser mode no need to check if default.prf is exist
- BSE does't setting su pam mode with right value
- BSE become slow when use 'hostname -f' to set FQDN




* Wed Apr 25 2018 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 2.1-2
- use SSH_MACS_VALUE items to set ssh cipher in secure_set/s11_sshCipher
- use $TEST_PAUSE_TIME value to replace with sleep sec.
- fix typo 'FINE' in include/profiles, should be 'FIND'
- use sqlite3 db to replace ascii changelog file to check software vulnerabilities
- add software vulnerabilities check func module based on sqlite3 db.
- modify html report style, make html result file more readable.
- update LOGFILE value format in bse
- modify shell console report style, make promote output info more readable.
- add comment info to detailized help info, to help people understand options meaning in default.prf
- release BSE 2.1.2

* Thu Dec 28 2017 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 2.1-1
- add default.prf to detailed configuration items.
- modify include/consts\functions\profiles to support detailed config.
- change install dir path to /opt/BCLinux/bse
- release BSE 2.1.1.

* Mon Aug 28 2017 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 2.0-1
- enrich the man.8 query file for bse.
- add httpd\tomcat\mysql\php\wget vulenrabilities database for bse.
- fix the fliter bugs in secure_check/c30 file.
- Add CVE details to html report
- Add update database interface to main file: bse

* Tue Aug 15 2017 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.4-1
- add man.8 query file for bse.
- Fix html compatibility for report file.
- use xml file to show suggestion info for each check items.

* Wed Jun 28 2017 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.3-1
- add html report support, generate html report file.

* Fri Mar 10 2017 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.2-1
- add auto complete to restore basic and adv func
- add warning info before user do restore
- change fix adv func output color and format

* Thu Mar 09 2017 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.1-4
- fix the ${PROFILE} valuable to show the real path of default.prf.
- modify the output format of fix adv func.

* Wed Mar 08 2017 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.1-3
- update check func, add option: basic & adv
- modify the help info format and add result info after fix
- create option_check dir and move relevant file to it
- modify the check result and use printf to show help info
- update the s25_addUser func to show passwd to user
- disable binaries check and fix the s40_syslogProperty vaule bugs
- update c02 & c03 to ensure just check /etc/pam.d/system-auth file
- modify the s04 & c04 to use /etc/pam.d/system-auth file
- add confirm info when do adv fix
- fix the parameters error, add shift when do -y
- fix the c26_filterIP bugs, delete ${i} valuable
- change c21&c24&c25&c26 FINISHED to OK

* Tue Mar 07 2017 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.1-2
- Adding OSdetection function to meet BCLinux 7.3 demand.
- Change excute shell script name from start.sh to bse.
- Add this tool's main call file "bse" to /usr/bin/.
- Fix the check_result.reslt file bugs, remove this file after fix the system.
- Fix the os_distro value bug.

* Wed Mar 01 2017 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.1-1
- Adding restore function, help user to restore the settings maked by this tools.
- Also change name form BCLinux-SecureH to bse.

* Sun Jan 15 2017 Gu Zhifeng <guzhifeng@cmss.chinamobile.com> 1.0
- build the program