rename modules_disabled -> lockdown

I.e. create tests for a special hardening profile whose configuration is to lock down all settings. This will include scanning for all unkown SUID-bits as well as kernel configuration with module lockdown.

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
add all current requirements from default -> lockdown

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
default profile checks SUID/SGID blacklist

Instead of going for the whitelist and expecting all other SUID/SGID bits to be removed, go for the blacklist in the default profile. This behavior is preferred, since we don't want to enable a search through all nodes on a system for any SUID/SGID bits by default. This search is desired and reasonable in all cases, but many new users will be turned away if we activate it by default. It causes issues with any regularly mounted network filesystems (which take very long) or very large (amount of entries on the filesystem) storage nodes.

We will add this point to the documentation, as it's the user's task to mount these components with a nosuid configuration.

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>
Merge pull request #19 from TelekomLabs/lockdown-mode

Lockdown mode