<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Security Baseline Checks — API Reference

## Baseline YAML Schema

```yaml
name: CIS Ubuntu 22.04 Level 1
version: "1.0"
checks:
  - id: CIS-1.1.1
    type: file_permissions
    path: /etc/passwd
    mode: "0644"
    owner: root
    description: "Ensure permissions on /etc/passwd are configured"

  - id: CIS-2.1.1
    type: service_disabled
    service: avahi-daemon
    description: "Ensure Avahi Server is not installed"

  - id: CIS-3.2.1
    type: sysctl
    key: net.ipv4.ip_forward
    value: "0"
    description: "Ensure IP forwarding is disabled"
```

## systemctl Commands

```bash
# Check if service enabled
systemctl is-enabled sshd        # enabled, disabled, masked

# Check if service running
systemctl is-active sshd         # active, inactive

# List all enabled services
systemctl list-unit-files --state=enabled

# List listening ports
ss -tlnp
```

## sysctl Commands

```bash
# Read parameter
sysctl net.ipv4.ip_forward

# Read all security-relevant
sysctl -a 2>/dev/null | grep -E 'forward|accept_redirects|rp_filter|syncookies'

# CIS-recommended kernel params
sysctl net.ipv4.conf.all.accept_source_route     # should be 0
sysctl net.ipv4.conf.all.accept_redirects         # should be 0
sysctl net.ipv4.conf.all.rp_filter                # should be 1
sysctl net.ipv4.tcp_syncookies                    # should be 1
```

## File Permission Checks

```bash
# Check critical files
stat -c "%a %U %G" /etc/passwd    # 644 root root
stat -c "%a %U %G" /etc/shadow    # 640 root shadow
stat -c "%a %U %G" /etc/gshadow   # 640 root shadow
stat -c "%a %U %G" /etc/group     # 644 root root

# Find world-writable files
find / -type f -perm -002 -exec ls -l {} \;

# Find SUID/SGID files
find / -type f \( -perm -4000 -o -perm -2000 \) -exec ls -l {} \;
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All baseline checks passed (100% compliant) |
| 1 | One or more checks failed |
| 2 | Runtime error or baseline file invalid |
