Git-Mirrors/Qubes-VM-hardening
1
0
Fork 0
mirror of https://github.com/tasket/Qubes-VM-hardening.git synced 2024-10-01 06:35:42 -04:00
Code Issues Packages Projects Releases Wiki Activity

move rc back before mount

Browse Source
This commit is contained in:
Christopher Laprise 2019-08-17 13:28:36 -04:00
parent 67315b0119
commit bbdc5b711b
No known key found for this signature in database
GPG Key ID: 448568C8B281C952
2 changed files with 16 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
.vm-boot-protect.sh.kate-swp Normal file
View File

Binary file not shown.

29
vm-boot-protect.sh
View File

@ -30,7 +30,7 @@ rwbak=$rw/vm-boot-protect
errlog=/var/run/vm-protect-error errlog=/var/run/vm-protect-error
servicedir=/var/run/qubes-service servicedir=/var/run/qubes-service
defdir=/etc/default/vms defdir=/etc/default/vms
version="0.9.0" version="0.9.1"
# Define sh, bash, X and desktop init scripts in /home/user # Define sh, bash, X and desktop init scripts in /home/user
# to be protected # to be protected
@ -111,11 +111,25 @@ abort_startup() {
echo >$errlog # Clear echo >$errlog # Clear
if qsvc vm-boot-protect-cli; then if qsvc vm-boot-protect-cli; then
abort_startup RELOCATE "CLI requested." abort_startup RELOCATE "CLI requested."
fi fi
# Run rc file commands if they exist
if qsvc vm-boot-protect-root && is_rwonly_persistent; then
# Get list of enabled tags from Qubes services
tags=`find $servicedir -name 'vm-boot-tag-*' -type f -printf '%f\n' \
| sort | sed -E 's|^vm-boot-tag-|\@tags/|'`
for rcbase in vms.all $tags $vmname; do
if [ -e "$defdir/$rcbase.rc" ]; then
. "$defdir/$rcbase.rc"
fi
done
fi
if qsvc vm-boot-protect || qsvc vm-boot-protect-root; then if qsvc vm-boot-protect || qsvc vm-boot-protect-root; then
# Mount private volume in temp location # Mount private volume in temp location
mkdir -p $rw mkdir -p $rw
@ -154,17 +168,6 @@ fi
if qsvc vm-boot-protect-root && is_rwonly_persistent; then if qsvc vm-boot-protect-root && is_rwonly_persistent; then
# Get list of enabled tags from Qubes services
tags=`find $servicedir -name 'vm-boot-tag-*' -type f -printf '%f\n' \
| sort | sed -E 's|^vm-boot-tag-|\@tags/|'`
# Run rc file commands if they exist
for rcbase in vms.all $tags $vmname; do
if [ -e "$defdir/$rcbase.rc" ]; then
. "$defdir/$rcbase.rc"
fi
done
# Check hashes # Check hashes
checkcode=0 checkcode=0
for sha_base in $vmname $tags vms.all; do for sha_base in $vmname $tags vms.all; do