import sys, os

os.chdir('/www/server/panel')
sys.path.append("class/")
import re, public

_title = '确保收集内核模块的加载和卸载'
_version = 1.0
_ps = '检查是否开启收集内核模块的加载和卸载'
_level = 1
_date = '2025-11-20'
_ignore = os.path.exists("data/warning/ignore/sw_audit_modules_events.pl")
_tips = [
    "在`/etc/audit/rules.d/audit.rules`与`/etc/audit/audit.rules`添加："
    "-w /sbin/insmod -p x -k modules",
    "-w /sbin/rmmod -p x -k modules",
    "-w /sbin/modprobe -p x -k modules",
    "-a always,exit -F arch=b64 -S init_module -S delete_module -k modules",
    "重载并重启审计：service auditd restart"
]
_help = ''
_remind = '未审计内核模块加载/卸载，内核级后门与稳定性异常难以追踪；启用modules规则后可记录insmod/rmmod/modprobe及init_module/delete_module系统调用，提升审计与溯源能力'


def check_run():
    try:
        files = ['/etc/audit/rules.d/audit.rules', '/etc/audit/audit.rules']
        contents = []
        for f in files:
            if os.path.exists(f):
                contents.append(public.readFile(f) or '')
        if not contents:
            return False, '未检测到审计规则文件：/etc/audit/rules.d/audit.rules 或 /etc/audit/audit.rules 缺失'
        body = '\n'.join(contents)
        missing_lines = []
        if not re.search(r'^\s*-w\s+/sbin/insmod\s+-p\s+x\s+-k\s+modules\s*$', body, re.M):
            missing_lines.append('-w /sbin/insmod -p x -k modules')
        if not re.search(r'^\s*-w\s+/sbin/rmmod\s+-p\s+x\s+-k\s+modules\s*$', body, re.M):
            missing_lines.append('-w /sbin/rmmod -p x -k modules')
        if not re.search(r'^\s*-w\s+/sbin/modprobe\s+-p\s+x\s+-k\s+modules\s*$', body, re.M):
            missing_lines.append('-w /sbin/modprobe -p x -k modules')
        if not re.search(
                r'^\s*-a\s+always,exit\s+-F\s+arch=b64\s+.*-S\s+init_module\s+.*-S\s+delete_module\s+.*-k\s+modules\s*$',
                body, re.M):
            missing_lines.append('-a always,exit -F arch=b64 -S init_module -S delete_module -k modules')
        if missing_lines:
            return False, '缺少modules审计规则：' + '；'.join(missing_lines)
        return True, '无风险'
    except:
        return True, '无风险'