Beta Branch add cmsec security check framework for kernel CVE detection in 140.00…

add cmsec security check framework for kernel CVE detection in 140.00beta01

When enabled via DMOTD_CVECHECK='y' in /etc/centminmod/custom_config.inc,
Centmin Mod servers now check at SSH login whether the running kernel is
patched against known CVEs and surface a coloured status line in the
message-of-the-day banner. Initial detection ships for CVE-2026-31431
(algif_aead local privilege escalation, CVSS 7.8) covering AlmaLinux 8/9/10,
Rocky 8/9/10, CloudLinux 7h/8/9/10, Oracle Linux 8/9/10, and Linode boot
kernels. Users can run cmsec from the shell for full per-CVE detail,
cmsec list to enumerate available checks, and cmsec --json for monitoring
integration. Default-off to match existing convention for security gates
(SSHLOGIN_KERNELCHECK, NEEDRESTART_CHECK).

tools/cmm-security/ content is byte-identical with 141.00beta01 and
132.00stable.

Changes:
- New tools/cmm-security/ extensible framework: cmsec.sh dispatcher with
subcommands run/list/check/probe and flags --json/--no-cache/--dmotd/
--quiet/--probe/--yes; lib/cache.sh state-based cache invalidation
keyed on uname -r + /etc/os-release ID:VERSION_ID + /proc/cmdline
mitigation flag + kcarectl digest + check-script SHA + baseline SHA,
with 24h TTL safety net, flock concurrency, atomic mv-based writes,
and stale-cache fallback under contention; lib/osdetect.sh shared
OS / kernel-track detection (Linode, EL8/9/10, EL7, container/chroot
via /proc/1/root inode comparison)
- New checks/check-cve-2026-31431.sh detection script (~981 lines,
detection-only — probe code separated into its own file)
- New probes/probe-cve-2026-31431.sh standalone AF_ALG bind probe with
--yes guard, SOC/EDR warning banner, 5-second pause; never invoked by
dmotd or cron paths
- dmotd.sh: new cmsec_checks() function mirroring kernel_checks() pattern,
gated on DMOTD_CVECHECK (default 'n'); push_dmotd_alerts() extended
with cve branch using per-(CVE,kernel) cooldown markers under
/var/cache/centminmod/cmsec/push/ to prevent Pushover spam on every
SSH login (24h cooldown window); cooldown marker only created when
curl exits 0 and Pushover API returns "status":1
- check-for-updates.sh: parallel cmsec_checks() integration via
push_update_alerts() for non-interactive paths
- inc/cpcheck.inc: cmsec symlink at /usr/bin/cmsec with self-heal for
dangling, wrong-target, and missing-symlink cases (readlink-based
comparison against expected SCRIPT_DIR target)
- inc/configfile_submenu.inc: persistent-config menu options 24/25/26
for enabling/disabling DMOTD_CVECHECK from the centmin.sh menu
- command_shortcuts.txt: documents cmsec, cmsec list, cmsec check
- Sunday=0 -> 7 fix in date +%u tests in dmotd.sh and check-for-updates.sh
needs-restarting weekend gate (ISO 8601 returns 7 for Sunday; previous
test-against-0 silently skipped Sunday)
- Linode kernel handling: vulnerable verdicts on Linode-format kernels
emit kernel-track-aware action text directing users to the Linode
Cloud Manager rather than dnf upgrade alone (Linode-supplied kernel
loads independently of the distro-managed kernel)
- Container/chroot detection: cmsec --json emits a synthesised "skipped"
document for non-derivable host-kernel verdicts so monitoring tools
receive a JSON document for every check, never empty stdout
- DMOTD_CVECHECK_SUPPRESS env var enables per-CVE suppression keyed on
(CVE + running-kernel + verdict); user acknowledgement auto-clears
when the kernel changes, forcing re-evaluation
- BASELINE_VERIFIED_DATE staleness signal: warns when baseline data is
older than 90 days; cmsec --json exposes baseline_age_days for
monitoring tools

---

Continue reading...

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01