Fixes

arch-hardening.sh

@@ -70,7 +70,7 @@ if pacman -Qi iptables &> /dev/null; then
     sudo pacman -R --noconfirm iptables
 fi
 sudo pacman -S --noconfirm --needed nftables
-echo "blacklist ip_tables" | sudo tee /etc/modprobe.d/blacklist-iptables.conf
+
 sudo tee /etc/modprobe.d/ip_tables-disable.conf > /dev/null <<EOL
 # Disable ip_tables to prevent conflicts with nftables
 blacklist ip_tables
@@ -88,7 +88,6 @@ sudo tee /etc/security/limits.d/20-disable-core-dumps.conf > /dev/null <<EOL
 * hard    core    0
 * soft    core    0
 EOL
-
 # Append to /etc/profile to enforce core dump restriction system-wide
 echo '# Set the core dump soft limit to 0 (current enforceable limit)' | sudo tee -a /etc/profile > /dev/null
 echo 'ulimit -S -c 0 > /dev/null 2>&1' | sudo tee -a /etc/profile > /dev/null
@@ -128,7 +127,6 @@ net.ipv6.conf.all.accept_redirects = 0
 net.ipv6.conf.default.accept_redirects = 0
 EOL
 
-# Apply settings now
 sudo sysctl --system
 
 # [SHLL-6220] Idle session handling
@@ -136,7 +134,7 @@ sudo sed -i 's/^#\?TMOUT=.*/TMOUT=900/' /etc/profile
 sudo sed -i 's/^#\?readonly TMOUT.*/readonly TMOUT/' /etc/profile
 sudo sed -i 's/^#\?export TMOUT.*/export TMOUT/' /etc/profile
 
-# [MACF-6290] Enable MAC framework
+# [MACF-6290] Enable MAC framework (AppArmor)
 sudo pacman -S --noconfirm --needed apparmor apparmor.d-git
 sudo systemctl enable --now apparmor
 
@@ -217,8 +215,16 @@ sudo tee /etc/issue > /dev/null <<EOL
 EOL
 
 # [HRDN-7220] Don't install /usr/bin/as by adding it to NoExtract
-if ! grep -q '^NoExtract\s*=\s*/usr/bin/as' /etc/pacman.conf; then
-    sudo sed -i '/^\[options\]/a NoExtract = /usr/bin/as' /etc/pacman.conf
+if sudo grep -q 'usr/bin/as' /etc/pacman.conf; then
+    : # already present
+else
+    if sudo grep -qE '^[[:space:]]*NoExtract' /etc/pacman.conf; then
+        sudo sed -i '0,/^[[:space:]]*NoExtract/ s|^\([[:space:]]*NoExtract[[:space:]]*=[[:space:]]*\)\(.*\)$|\1\2 usr/bin/as|' /etc/pacman.conf
+    elif sudo grep -qE '^[[:space:]]*#[[:space:]]*NoExtract' /etc/pacman.conf; then
+        sudo sed -i '/^[[:space:]]*#[[:space:]]*NoExtract/ a NoExtract = usr/bin/as' /etc/pacman.conf
+    else
+        sudo bash -c 'printf "\n# NoExtract added by hardening script\nNoExtract = usr/bin/as\n" >> /etc/pacman.conf'
+    fi
 fi
 
 # [HRDN-7222] Restricting compilator access to root user only