mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-07 05:50:41 +07:00
Code Issues Packages Projects Releases Wiki Activity

permission-hardening: Fix issue with pipelining failures causing incorrect user/group lookup results

Browse Source
This commit is contained in:
Kuri Schlarb 2022-06-07 08:03:56 +00:00 committed by GitHub
parent 616fe857f7
commit 9fd8e1c9b0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
usr/libexec/security-misc/permission-hardening
View File

@ -318,12 +318,12 @@ set_file_perms() {
continue
fi
if ! getent passwd | grep -q "^${owner_from_config}:" ; then
if ! echo "${passwd_file_contents}" | grep -q "^${owner_from_config}:" ; then
echo "ERROR: owner_from_config '$owner_from_config' does not exist!" >&2
continue
fi
if ! getent group | grep -q "^${group_from_config}:" ; then
if ! echo "${group_file_contents}" | grep -q "^${group_from_config}:" ; then
echo "ERROR: group_from_config '$group_from_config' does not exist!" >&2
continue
fi
@ -462,6 +462,15 @@ set_file_perms() {
}
parse_config_folder() {
# Query contents of password and group databases only once and buffer them
#
# If we don’t buffer we sometimes get incorrect results when checking for entries using
# `if getent passwd | grep -q '^root:'; …` since `grep` exits after the first match in
# this case causing `getent` to receive SIGPIPE, which then fails the pipeline since
# `set -o pipefail` is set for this script.
passwd_file_contents="$(getent passwd)"
group_file_contents="$(getent group)"
shopt -s nullglob
for config_file in /etc/permission-hardening.d/*.conf /usr/local/etc/permission-hardening.d/*.conf; do
set_file_perms