mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-08 14:23:33 +07:00
Code Issues Packages Projects Releases Wiki Activity

hide-hardware-info: re-enable restrictions on sysfs when using SELinux

Browse Source 
When using SELinux, restrict the parts of sysfs explicitly to ensure
restrictions are working as expected.
This commit is contained in:
0xC0ncord 2021-10-08 22:11:58 -04:00
parent 96026a5e90
commit 060d7d890a
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
usr/libexec/security-misc/hide-hardware-info
View File

@ -88,6 +88,16 @@ done
## properly ## properly
if [ -d /sys/fs/selinux ]; then if [ -d /sys/fs/selinux ]; then
if [ "${selinux}" = "1" ]; then if [ "${selinux}" = "1" ]; then
## restrict permissions on everything but
## what is needed
for i in /sys/* /sys/fs/*
do
if [ "${sysfs_whitelist}" = "1" ]; then
chmod o-rwx "${i}"
else
chmod og-rwx "${i}"
fi
done
chmod o+rx /sys /sys/fs /sys/fs/selinux chmod o+rx /sys /sys/fs /sys/fs/selinux
echo "INFO: SELinux mode enabled. Restrictions loosened slightly in order to allow userspace utilities to function." echo "INFO: SELinux mode enabled. Restrictions loosened slightly in order to allow userspace utilities to function."
else else