mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-03-10 12:53:31 +07:00
Code Issues Packages Projects Releases Wiki Activity

refactoring

Browse Source
This commit is contained in:
Patrick Schleizer 2019-12-20 04:08:46 -05:00
parent f92b414195
commit bb84fca184
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 34 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
usr/lib/security-misc/permission-hardening
View File

@ -17,47 +17,43 @@ echo_wrapper() {
#"$@" #"$@"
} }
add_statoverride_entry() { add_nosuid_statoverride_entry() {
if [ "${nosuid}" = "true" ]; then echo "fso: $fso"
echo "fso: $fso" while read -r line; do
while read -r line; do if ! read -r file_name existing_mode owner group; then
if ! read -r file_name existing_mode owner group; then continue
continue fi
## -h file True if file is a symbolic Link.
## -u file True if file has its set-user-id bit set.
## -g file True if file has its set-group-id bit set.
if test -h "$file_name" ; then
## https://forums.whonix.org/t/kernel-hardening/7296/323
true "skip symlink: $file_name"
continue
fi
if test -u "$file_name" || test -g "$file_name"; then
string_length_of_existing_mode="${#existing_mode}"
if [ "$string_length_of_existing_mode" = "4" ]; then
new_mode="${existing_mode:1}"
else
new_mode="$existing_mode"
fi fi
## -h file True if file is a symbolic Link. echo "suid - file_name: '$file_name' | existing_mode: '$existing_mode' | new_mode: '$new_mode'"
## -u file True if file has its set-user-id bit set.
## -g file True if file has its set-group-id bit set.
if test -h "$file_name" ; then if dpkg-statoverride --list | grep -q "$file_name"; then
## https://forums.whonix.org/t/kernel-hardening/7296/323 if ! dpkg-statoverride --list | grep -q "$owner $group $new_mode $file_name"; then
true "skip symlink: $file_name" echo_wrapper dpkg-statoverride --remove "$file_name"
continue
fi
if test -u "$file_name" || test -g "$file_name"; then
string_length_of_existing_mode="${#existing_mode}"
if [ "$string_length_of_existing_mode" = "4" ]; then
new_mode="${existing_mode:1}"
else
new_mode="$existing_mode"
fi
echo "suid - file_name: '$file_name' | existing_mode: '$existing_mode' | new_mode: '$new_mode'"
if dpkg-statoverride --list | grep -q "$file_name"; then
if ! dpkg-statoverride --list | grep -q "$owner $group $new_mode $file_name"; then
echo_wrapper dpkg-statoverride --remove "$file_name"
echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$new_mode" "$file_name"
fi
else
echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$new_mode" "$file_name" echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$new_mode" "$file_name"
fi fi
else
echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$new_mode" "$file_name"
fi fi
done < <( stat -c "%n %a %U %G" "${fso_without_trailing_slash}/"** ) fi
else done < <( stat -c "%n %a %U %G" "${fso_without_trailing_slash}/"** )
echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$mode_from_config" "$fso_without_trailing_slash"
fi
} }
set_file_perms() { set_file_perms() {
@ -100,7 +96,7 @@ set_file_perms() {
## If mode_from_config is "nosuid" the config does not set owner and ## If mode_from_config is "nosuid" the config does not set owner and
## group. Therefore do not enforce owner/group check. ## group. Therefore do not enforce owner/group check.
add_statoverride_entry add_nosuid_statoverride_entry
else else
if ! seq -w 000 4777 | grep -qw "$mode_from_config"; then if ! seq -w 000 4777 | grep -qw "$mode_from_config"; then
echo "ERROR: Mode '$mode_from_config' is invalid!" >&2 echo "ERROR: Mode '$mode_from_config' is invalid!" >&2
@ -125,18 +121,14 @@ set_file_perms() {
## fso_without_trailing_slash instead of fso to prevent ## fso_without_trailing_slash instead of fso to prevent
## "dpkg-statoverride: warning: stripping trailing /" ## "dpkg-statoverride: warning: stripping trailing /"
echo_wrapper dpkg-statoverride --remove "$fso_without_trailing_slash" echo_wrapper dpkg-statoverride --remove "$fso_without_trailing_slash"
add_statoverride_entry echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$mode_from_config" "$fso_without_trailing_slash"
fi fi
else else
## There is no fso entry. Therefore add one. ## There is no fso entry. Therefore add one.
add_statoverride_entry echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$mode_from_config" "$fso_without_trailing_slash"
fi fi
fi fi
if [ "$capability" = "" ]; then if [ "$capability" = "" ]; then
continue continue
fi fi