Git-Mirrors/Qubes-VM-hardening
1
0
Fork 0
mirror of https://github.com/tasket/Qubes-VM-hardening.git synced 2025-12-14 23:59:12 -05:00
Code Issues Projects Releases Packages Wiki Activity

bak dir path and issue 11

Browse source
This commit is contained in:
Christopher Laprise 2018-03-29 07:22:22 -04:00
parent e6a00324f2
commit 244cb77b78
No known key found for this signature in database
GPG key ID: 448568C8B281C952
2 changed files with 12 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

7
install
View file

@ -1,14 +1,15 @@
#!/bin/sh #!/bin/sh
[ `id -u` -eq 0 ] || exit [ `id -u` -eq 0 ] || exit
echo Disabling the pre-release service (if present)...
systemctl disable vm-sudo-protect.service
cp vm-boot-protect.sh /usr/lib/qubes/init cp vm-boot-protect.sh /usr/lib/qubes/init
chmod +x /usr/lib/qubes/init/vm-boot-protect.sh chmod +x /usr/lib/qubes/init/vm-boot-protect.sh
cp vm-boot-protect.service /lib/systemd/system cp vm-boot-protect.service /lib/systemd/system
systemctl daemon-reload systemctl daemon-reload
systemctl enable vm-boot-protect.service systemctl enable vm-boot-protect.service
echo Disabling the pre-release service (if present)... echo
systemctl disable vm-sudo-protect.service
echo vm-boot-protect installed! echo vm-boot-protect installed!

12
vm-boot-protect.sh
View file

@ -77,11 +77,12 @@ if qsvc vm-boot-protect-root && is_rwonly_persistent; then
cd /root cd /root
# Deactivate private.img config dirs # Deactivate private.img config dirs
mkdir -p `dirname $dir`/vm-boot-protect
for dir in $privdirs; do for dir in $privdirs; do
bakdir=`dirname $dir`/BAK-`basename $dir` bakdir=`dirname $dir`/vm-boot-protect/BAK-`basename $dir`
bak2dir=`dirname $dir`/BAK2-`basename $dir` origdir=`dirname $dir`/vm-boot-protect/ORIG-`basename $dir`
if [ -d $bakdir ] && [ ! -d $bak2dir ]; then if [ -d $bakdir ] && [ ! -d $origdir ]; then
mv $bakdir $bak2dir mv $bakdir $origdir
fi fi
rm -rf $bakdir rm -rf $bakdir
mv $dir $bakdir mv $dir $bakdir
@ -119,6 +120,9 @@ if qsvc vm-boot-protect-root && is_rwonly_persistent; then
if [ -d $defdir/$vmset/rw ]; then if [ -d $defdir/$vmset/rw ]; then
cp -af "$defdir/$vmset/rw/*" $rw cp -af "$defdir/$vmset/rw/*" $rw
fi fi
# Keep configs invisible at runtime...
rm -rf $defdir/*
done done