mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-03-10 04:48:10 +07:00
Code Issues Packages Projects Releases Wiki Activity

refactoring

Browse Source
This commit is contained in:
Patrick Schleizer 2019-12-20 04:06:28 -05:00
parent 4c44871e9d
commit f92b414195
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 20 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
usr/lib/security-misc/permission-hardening
View File

@ -91,12 +91,16 @@ set_file_perms() {
fso_without_trailing_slash="${fso%/}" fso_without_trailing_slash="${fso%/}"
## Use dpkg-statoverride so permissions are not reset during upgrades.
nosuid="" nosuid=""
if [ "$mode_from_config" = "nosuid" ]; then if [ "$mode_from_config" = "nosuid" ]; then
nosuid="true" nosuid="true"
## If mode_from_config is "nosuid" the config does not set owner and ## If mode_from_config is "nosuid" the config does not set owner and
## group. Therefore do not enforce owner/group check. ## group. Therefore do not enforce owner/group check.
add_statoverride_entry
else else
if ! seq -w 000 4777 | grep -qw "$mode_from_config"; then if ! seq -w 000 4777 | grep -qw "$mode_from_config"; then
echo "ERROR: Mode '$mode_from_config' is invalid!" >&2 echo "ERROR: Mode '$mode_from_config' is invalid!" >&2
@ -112,25 +116,27 @@ set_file_perms() {
echo "ERROR: Group '$group' does not exist!" >&2 echo "ERROR: Group '$group' does not exist!" >&2
continue continue
fi fi
fi
## Use dpkg-statoverride so permissions are not reset during upgrades. ## Check there is an entry for the fso.
if dpkg-statoverride --list | grep -q "$fso_without_trailing_slash"; then
## Check there is an entry for the fso. ## There is an fso entry. Check if owner/group/mode match.
if dpkg-statoverride --list | grep -q "$fso_without_trailing_slash"; then if ! dpkg-statoverride --list | grep -q "$owner $group $mode_from_config $fso_without_trailing_slash"; then
## There is an fso entry. Check if owner/group/mode match. ## The owner/group/mode do not match, therefore remove and re-add the entry to update it.
if ! dpkg-statoverride --list | grep -q "$owner $group $mode_from_config $fso_without_trailing_slash"; then ## fso_without_trailing_slash instead of fso to prevent
## The owner/group/mode do not match, therefore remove and re-add the entry to update it. ## "dpkg-statoverride: warning: stripping trailing /"
## fso_without_trailing_slash instead of fso to prevent echo_wrapper dpkg-statoverride --remove "$fso_without_trailing_slash"
## "dpkg-statoverride: warning: stripping trailing /" add_statoverride_entry
echo_wrapper dpkg-statoverride --remove "$fso_without_trailing_slash" fi
else
## There is no fso entry. Therefore add one.
add_statoverride_entry add_statoverride_entry
fi fi
else
## There is no fso entry. Therefore add one.
add_statoverride_entry
fi fi
if [ "$capability" = "" ]; then if [ "$capability" = "" ]; then
continue continue
fi fi