mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-03-09 20:30:23 +07:00
Code Issues Packages Projects Releases Wiki Activity

SUID Disabler and Permission Hardener: introduce configuration option to disable all whitelists

Browse Source 
`whitelists_disable_all=true`
This commit is contained in:
Patrick Schleizer 2020-12-01 05:14:48 -05:00
parent b09cc0de6a
commit c031f22995
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
etc/permission-hardening.d/30_default.conf
View File

@ -15,6 +15,12 @@
## TODO: white spaces inside file name untested and probably will not work.
######################################################################
# Global Settings
######################################################################
#whitelists_disable_all=true
######################################################################
# SUID disablewhitelist
######################################################################

10
usr/lib/security-misc/permission-hardening
View File

@ -177,7 +177,9 @@ add_nosuid_statoverride_entry() {
fi
done
if [ "$is_disable_whitelisted" = "true" ]; then
if [ "$whitelists_disable_all" = "true" ]; then
true "INFO: whitelists_disable_all=true - $setuid_output $setsgid_output found - file_name: '$file_name' | existing_mode: '$existing_mode'"
elif [ "$is_disable_whitelisted" = "true" ]; then
echo "INFO: white list disabled - $setuid_output $setsgid_output found - file_name: '$file_name' | existing_mode: '$existing_mode'"
else
if [ "$is_exact_whitelisted" = "true" ]; then
@ -252,6 +254,12 @@ set_file_perms() {
exit "$exit_code"
fi
if [ "$line" = 'whitelists_disable_all=true' ]; then
whitelists_disable_all=true
echo "INFO: whitelists_disable_all=true - all whitelists disabled."
continue
fi
#global fso
local mode_from_config owner_from_config group_from_config capability_from_config
if ! read -r fso mode_from_config owner_from_config group_from_config capability_from_config <<< "$line" ; then