mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-03-10 12:53:31 +07:00
Code Issues Packages Projects Releases Wiki Activity

refactoring

Browse Source
This commit is contained in:
Patrick Schleizer 2019-12-20 04:08:46 -05:00
parent f92b414195
commit bb84fca184
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 34 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
usr/lib/security-misc/permission-hardening
View File

@ -17,8 +17,7 @@ echo_wrapper() {
#"$@" #"$@"
} }
add_statoverride_entry() { add_nosuid_statoverride_entry() {
if [ "${nosuid}" = "true" ]; then
echo "fso: $fso" echo "fso: $fso"
while read -r line; do while read -r line; do
if ! read -r file_name existing_mode owner group; then if ! read -r file_name existing_mode owner group; then
@ -55,9 +54,6 @@ add_statoverride_entry() {
fi fi
fi fi
done < <( stat -c "%n %a %U %G" "${fso_without_trailing_slash}/"** ) done < <( stat -c "%n %a %U %G" "${fso_without_trailing_slash}/"** )
else
echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$mode_from_config" "$fso_without_trailing_slash"
fi
} }
set_file_perms() { set_file_perms() {
@ -100,7 +96,7 @@ set_file_perms() {
## If mode_from_config is "nosuid" the config does not set owner and ## If mode_from_config is "nosuid" the config does not set owner and
## group. Therefore do not enforce owner/group check. ## group. Therefore do not enforce owner/group check.
add_statoverride_entry add_nosuid_statoverride_entry
else else
if ! seq -w 000 4777 | grep -qw "$mode_from_config"; then if ! seq -w 000 4777 | grep -qw "$mode_from_config"; then
echo "ERROR: Mode '$mode_from_config' is invalid!" >&2 echo "ERROR: Mode '$mode_from_config' is invalid!" >&2
@ -125,18 +121,14 @@ set_file_perms() {
## fso_without_trailing_slash instead of fso to prevent ## fso_without_trailing_slash instead of fso to prevent
## "dpkg-statoverride: warning: stripping trailing /" ## "dpkg-statoverride: warning: stripping trailing /"
echo_wrapper dpkg-statoverride --remove "$fso_without_trailing_slash" echo_wrapper dpkg-statoverride --remove "$fso_without_trailing_slash"
add_statoverride_entry echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$mode_from_config" "$fso_without_trailing_slash"
fi fi
else else
## There is no fso entry. Therefore add one. ## There is no fso entry. Therefore add one.
add_statoverride_entry echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$mode_from_config" "$fso_without_trailing_slash"
fi fi
fi fi
if [ "$capability" = "" ]; then if [ "$capability" = "" ]; then
continue continue
fi fi