mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-10 15:17:57 +07:00
Code Issues Packages Projects Releases Wiki Activity

fix

Browse Source
This commit is contained in:
Patrick Schleizer 2019-12-21 05:51:22 -05:00
parent 234ec5fe93
commit e3355843c8
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
usr/lib/security-misc/permission-hardening
View File

@ -169,13 +169,13 @@ add_nosuid_statoverride_entry() {
echo "INFO: $setuid_output $setsgid_output found - file_name: '$file_name' | existing_mode: '$existing_mode' | new_mode: '$new_mode'" echo "INFO: $setuid_output $setsgid_output found - file_name: '$file_name' | existing_mode: '$existing_mode' | new_mode: '$new_mode'"
if dpkg-statoverride --list "$file_name" $dpkg_admindir_parameter_existing_mode ; then if dpkg-statoverride $dpkg_admindir_parameter_existing_mode --list "$file_name" ; then
## Existing mode already saved previously. No need to save again. ## Existing mode already saved previously. No need to save again.
true OK true OK
else else
## Save existing_mode in separate database. ## Save existing_mode in separate database.
## Not using --update as not intending to enforce existing_mode. ## Not using --update as not intending to enforce existing_mode.
echo_wrapper_silent_audit --add "$existing_owner" "$existing_group" "$existing_mode" "$file_name" $dpkg_admindir_parameter_existing_mode echo_wrapper_silent_audit $dpkg_admindir_parameter_existing_mode --add "$existing_owner" "$existing_group" "$existing_mode" "$file_name"
fi fi
## No need to check "dpkg-statoverride --list" for existing entries. ## No need to check "dpkg-statoverride --list" for existing entries.
@ -186,7 +186,7 @@ add_nosuid_statoverride_entry() {
echo_wrapper_ignore dpkg-statoverride --remove "$file_name" echo_wrapper_ignore dpkg-statoverride --remove "$file_name"
## Remove from separate database. ## Remove from separate database.
echo_wrapper_ignore dpkg-statoverride --remove "$file_name" $dpkg_admindir_parameter_new_mode echo_wrapper_ignore dpkg-statoverride $dpkg_admindir_parameter_new_mode --remove "$file_name"
## Add to real database and use --update to make changes on disk. ## Add to real database and use --update to make changes on disk.
echo_wrapper_audit dpkg-statoverride --add --update "$existing_owner" "$existing_group" "$new_mode" "$file_name" echo_wrapper_audit dpkg-statoverride --add --update "$existing_owner" "$existing_group" "$new_mode" "$file_name"
@ -346,16 +346,16 @@ set_file_perms() {
## fso_without_trailing_slash instead of fso to prevent ## fso_without_trailing_slash instead of fso to prevent
## "dpkg-statoverride: warning: stripping trailing /" ## "dpkg-statoverride: warning: stripping trailing /"
if dpkg-statoverride --list "$fso_without_trailing_slash" $dpkg_admindir_parameter_existing_mode ; then if dpkg-statoverride $dpkg_admindir_parameter_existing_mode --list "$fso_without_trailing_slash" ; then
## Existing mode already saved previously. No need to save again. ## Existing mode already saved previously. No need to save again.
true OK true OK
else else
## Save existing_mode in separate database. ## Save existing_mode in separate database.
## Not using --update as not intending to enforce existing_mode. ## Not using --update as not intending to enforce existing_mode.
echo_wrapper_silent_audit --add "$existing_owner" "$existing_group" "$existing_mode" "$fso_without_trailing_slash" $dpkg_admindir_parameter_existing_mode echo_wrapper_silent_audit $dpkg_admindir_parameter_existing_mode --add "$existing_owner" "$existing_group" "$existing_mode" "$fso_without_trailing_slash"
fi fi
echo_wrapper_audit dpkg-statoverride --remove "$fso_without_trailing_slash" $dpkg_admindir_parameter_new_mode echo_wrapper_audit dpkg-statoverride $dpkg_admindir_parameter_new_mode --remove "$fso_without_trailing_slash"
## Remove from and add to real database. ## Remove from and add to real database.
echo_wrapper_audit dpkg-statoverride --remove "$fso_without_trailing_slash" echo_wrapper_audit dpkg-statoverride --remove "$fso_without_trailing_slash"
@ -363,18 +363,18 @@ set_file_perms() {
## Save in separate database. ## Save in separate database.
## Not using --update as this is only for saving. ## Not using --update as this is only for saving.
echo_wrapper_silent_audit dpkg-statoverride --add "$owner_from_config" "$group_from_config" "$mode_from_config" "$fso_without_trailing_slash" $dpkg_admindir_parameter_new_mode echo_wrapper_silent_audit dpkg-statoverride $dpkg_admindir_parameter_new_mode --add "$owner_from_config" "$group_from_config" "$mode_from_config" "$fso_without_trailing_slash"
fi fi
else else
## There is no fso entry. Therefore add one. ## There is no fso entry. Therefore add one.
if dpkg-statoverride --list "$fso_without_trailing_slash" $dpkg_admindir_parameter_existing_mode ; then if dpkg-statoverride $dpkg_admindir_parameter_existing_mode --list "$fso_without_trailing_slash" ; then
## Existing mode already saved previously. No need to save again. ## Existing mode already saved previously. No need to save again.
true OK true OK
else else
## Save existing_mode in separate database. ## Save existing_mode in separate database.
## Not using --update as not intending to enforce existing_mode. ## Not using --update as not intending to enforce existing_mode.
echo_wrapper_silent_audit --add "$existing_owner" "$existing_group" "$existing_mode" "$fso_without_trailing_slash" $dpkg_admindir_parameter_existing_mode echo_wrapper_silent_audit $dpkg_admindir_parameter_existing_mode --add "$existing_owner" "$existing_group" "$existing_mode" "$fso_without_trailing_slash"
fi fi
## Add to real database. ## Add to real database.
@ -382,7 +382,7 @@ set_file_perms() {
## Save in separate database. ## Save in separate database.
## Not using --update as this is only for saving. ## Not using --update as this is only for saving.
echo_wrapper_silent_audit dpkg-statoverride --add "$owner_from_config" "$group_from_config" "$mode_from_config" "$fso_without_trailing_slash" $dpkg_admindir_parameter_new_mode echo_wrapper_silent_audit dpkg-statoverride $dpkg_admindir_parameter_new_mode --add "$owner_from_config" "$group_from_config" "$mode_from_config" "$fso_without_trailing_slash"
fi fi
fi fi