From c35bdf6cad4e045ccca91460c788067204d9d219 Mon Sep 17 00:00:00 2001
From: yaoxiyao <yaoxiyao@kylinsec.com.cn>
Date: Sat, 11 Oct 2025 19:31:45 +0800
Subject: [PATCH] =?UTF-8?q?=E6=8F=90=E4=BA=A401-noAuditd-audadm.sh?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 testcases/SOP/audadm/01-noAuditd-audadm.sh | 81 ++++++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100755 testcases/SOP/audadm/01-noAuditd-audadm.sh

diff --git a/testcases/SOP/audadm/01-noAuditd-audadm.sh b/testcases/SOP/audadm/01-noAuditd-audadm.sh
new file mode 100755
index 0000000..0de5c42
--- /dev/null
+++ b/testcases/SOP/audadm/01-noAuditd-audadm.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+
+# ----------------------------------------------------------------------
+# Filename	:  01-noAuditd-audadm.sh
+# Version	:  1.0
+# Date		:  2020/05/29
+# Author	:  Lz
+# Email		:  lz843723683@gmail.com
+# History	:     
+#                  Version 1.0, 2020/05/29
+# Function	： 测试三权分立 - 不能进行审计服务管理
+# Out		:        
+#              0 => TPASS
+#              1 => TFAIL
+#              other=> TCONF
+# ----------------------------------------------------------------------
+
+# 测试主题
+Title_Env_LTFLIB="三权分立(audadm) - 不能进行审计服务管理"
+
+HeadFile_Source_LTFLIB="${LIB_SSHAUTO}"
+
+## TODO : 个性化,初始化
+#   Out : 0=>TPASS
+#         1=>TFAIL
+#         2=>TCONF
+TestInit_LTFLIB(){
+	return ${TPASS}
+}
+
+
+## TODO : 清理函数
+#   Out : 0=>TPASS
+#         1=>TFAIL
+#         2=>TCONF
+TestClean_LTFLIB(){
+	return ${TPASS}
+}
+
+
+## TODO ：系统不可以查看审计服务
+testcase_1(){
+	local cmd="sudo systemctl status auditd"
+	SshAuto_CmdLocalAud_LTFLIB "$cmd" "no" "yes"
+	TestRetParse_LTFLIB "audadm 不可执行 $cmd" "False"
+}
+
+
+## TODO ：audadm不可以停止审计服务
+testcase_2(){
+	local cmd="sudo systemctl stop auditd"
+        SshAuto_CmdLocalAud_LTFLIB "$cmd" "no" "yes"
+        TestRetParse_LTFLIB "audadm 不可执行 $cmd" "False"
+}
+
+
+## TODO ：audadm不可以开启审计服务
+testcase_3(){
+	local cmd="sudo systemctl restart auditd"
+        SshAuto_CmdLocalAud_LTFLIB "$cmd" "no" "yes"
+        TestRetParse_LTFLIB "audadm 不可执行 $cmd" "False"
+}
+
+
+## TODO : 测试用例集
+#   Out : 0=>TPASS
+#         1=>TFAIL
+#         2=>TCONF
+Testsuite_LTFLIB(){
+	testcase_1
+	testcase_2
+	testcase_3
+
+	return $TPASS
+}
+
+
+#----------------------------------------------#
+
+source "${LIB_LTFLIB}"
+Main_LTFLIB $@
-- 
Gitee