id: prelink-not-installed-check

info:
  name: Ensure Prelink is Not Installed
  author: Th3l0newolf
  severity: medium
  description: |
    This template checks whether the prelink package is installed.
    Prelink modifies binaries to decrease application startup time, but it
    interferes with file integrity monitoring and is not recommended on
    secure systems.
  remediation: |
    Remove the prelink package if it is installed:
      sudo apt remove prelink -y
  reference:
    - https://www.cisecurity.org/benchmark/ubuntu_linux
  tags: cis,linux,ubuntu,prelink,package,audit
  metadata:
    verified: true

self-contained: true

code:
  - engine:
      - bash
    args:
      - "-c"
      - |
        if dpkg-query -s prelink &>/dev/null; then
          echo "[prelink-not-installed-check:Policy-Fail] [prelink is installed] [CIS_FAIL] [medium]"
        else
          echo "[prelink-not-installed-check:Policy-Pass] [prelink is not installed] [CIS_PASS] [medium]"
        fi

    matchers:
      - type: word
        name: policy-pass
        words:
          - "Policy-Pass"

      - type: word
        name: policy-fail
        words:
          - "Policy-Fail"
# digest: 4a0a00473045022100c4e5c119744b7079c44408522880e76d2c682b313df4d0f48dff17eeb1c1f7220220386bd07b1ae18d94f3c0dc5e6d1d0db5cee4e92d3109a171060d2f0555fe2ad5:922c64590222798bb761d5b6d8e72950