ファイルから文字列を読み取り、2番目のファイルの各行と比較する方法

私は強化部分を含むOSのインストール後にスクリプトを作成しています。この拡張セクションでは、ファイルAからカーネルパラメータを読み取り、それを/etc/sysctl.confファイルと比較します。パラメータがsysctl.confで利用できない場合は、それをsysctl.confに追加します。

カスタムファイルのパラメータ

################## Hardening ############################

kernel.exec-shield = 1
kernel.randomize_va_space = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.log_martians = 1
net.ipv4.tcp_timestamps = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

##########################################################

今、強化のために次の行を追加しました。

for i in $(cat /etc/sysctl.conf)
do
        if ! grep -Fxq " $i " /etc/sysctl.conf
        then
        echo -e "$i" > ~/testfile
        fi
done

このスクリプトの問題は、カーネルパラメータのすべての空白を空白の1行として処理し、「for i in $（cat /etc/sysctl.conf）」の先頭で問題が始まることです。

デバッグ情報です

./LinuxHardening.sh
++ date
+ LOGDATE='Mon Feb  9 07:58:07 EST 2015'
+ echo Mon Feb 9 07:58:07 EST 2015
+ tee HardeningLog
Mon Feb 9 07:58:07 EST 2015
+ echo -e '\n############ Kernel Hardening ############'
+ tee -a HardeningLog

############ Kernel Hardening ############
++ cat kernelparms
+ for i in '$(cat kernelparms)'
+ grep -Fxq '##################' /etc/sysctl.conf
+ echo -e '##################'
+ for i in '$(cat kernelparms)'
+ grep -Fxq Hardening /etc/sysctl.conf
+ echo -e Hardening
+ for i in '$(cat kernelparms)'
+ grep -Fxq '############################' /etc/sysctl.conf
+ echo -e '############################'
+ for i in '$(cat kernelparms)'
+ grep -Fxq kernel.exec-shield /etc/sysctl.conf
+ echo -e kernel.exec-shield
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 1 /etc/sysctl.conf
+ echo -e 1
+ for i in '$(cat kernelparms)'
+ grep -Fxq kernel.randomize_va_space /etc/sysctl.conf
+ echo -e kernel.randomize_va_space
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 1 /etc/sysctl.conf
+ echo -e 1
+ for i in '$(cat kernelparms)'
+ grep -Fxq net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf
+ echo -e net.ipv4.icmp_echo_ignore_broadcasts
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 1 /etc/sysctl.conf
+ echo -e 1
+ for i in '$(cat kernelparms)'
+ grep -Fxq net.ipv4.icmp_ignore_bogus_error_responses /etc/sysctl.conf
+ echo -e net.ipv4.icmp_ignore_bogus_error_responses
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 1 /etc/sysctl.conf
+ echo -e 1
+ for i in '$(cat kernelparms)'
+ grep -Fxq net.ipv4.tcp_syncookies /etc/sysctl.conf
+ echo -e net.ipv4.tcp_syncookies
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 1 /etc/sysctl.conf
+ echo -e 1
+ for i in '$(cat kernelparms)'
+ grep -Fxq net.ipv4.conf.all.log_martians /etc/sysctl.conf
+ echo -e net.ipv4.conf.all.log_martians
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 1 /etc/sysctl.conf
+ echo -e 1
+ for i in '$(cat kernelparms)'
+ grep -Fxq net.ipv4.conf.all.accept_redirects /etc/sysctl.conf
+ echo -e net.ipv4.conf.all.accept_redirects
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 0 /etc/sysctl.conf
+ echo -e 0
+ for i in '$(cat kernelparms)'
+ grep -Fxq net.ipv4.conf.all.rp_filter /etc/sysctl.conf
+ echo -e net.ipv4.conf.all.rp_filter
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 1 /etc/sysctl.conf
+ echo -e 1
+ for i in '$(cat kernelparms)'
+ grep -Fxq net.ipv4.conf.all.send_redirects /etc/sysctl.conf
+ echo -e net.ipv4.conf.all.send_redirects
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 0 /etc/sysctl.conf
+ echo -e 0
+ for i in '$(cat kernelparms)'
+ grep -Fxq net.ipv4.conf.default.accept_redirects /etc/sysctl.conf
+ echo -e net.ipv4.conf.default.accept_redirects
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 0 /etc/sysctl.conf
+ echo -e 0
+ for i in '$(cat kernelparms)'
+ grep -Fxq net.ipv4.conf.default.log_martians /etc/sysctl.conf
+ echo -e net.ipv4.conf.default.log_martians
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 1 /etc/sysctl.conf
+ echo -e 1
+ for i in '$(cat kernelparms)'
+ grep -Fxq net.ipv4.tcp_timestamps /etc/sysctl.conf
+ echo -e net.ipv4.tcp_timestamps
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 0 /etc/sysctl.conf
+ echo -e 0
+ for i in '$(cat kernelparms)'
+ grep -Fxq net.ipv6.conf.all.accept_redirects /etc/sysctl.conf
+ echo -e net.ipv6.conf.all.accept_redirects
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 0 /etc/sysctl.conf
+ echo -e 0
+ for i in '$(cat kernelparms)'
+ grep -Fxq net.ipv6.conf.default.accept_redirects /etc/sysctl.conf
+ echo -e net.ipv6.conf.default.accept_redirects
+ for i in '$(cat kernelparms)'
+ grep -Fxq = /etc/sysctl.conf
+ echo -e =
+ for i in '$(cat kernelparms)'
+ grep -Fxq 0 /etc/sysctl.conf
+ echo -e 0
+ for i in '$(cat kernelparms)'
+ grep -Fxq '##########################################################' /etc/sysctl.conf
+ echo -e '##########################################################'