Git-Mirrors/Qubes-VM-hardening
1
0
Fork 0
mirror of https://github.com/tasket/Qubes-VM-hardening.git synced 2024-10-01 06:35:42 -04:00
Code Issues Packages Projects Releases Wiki Activity

Make rm -rf safer

Browse Source
This commit is contained in:
Christopher Laprise 2018-04-03 11:01:31 -04:00
parent 425a1ab971
commit ca36bbe7e7
No known key found for this signature in database
GPG Key ID: 448568C8B281C952
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
vm-boot-protect.sh
View File

@ -17,6 +17,8 @@ chdirs="bin .local/bin .config/autostart .config/plasma-workspace/env \
vmname=`qubesdb-read /name` vmname=`qubesdb-read /name`
rw=/mnt/rwtmp rw=/mnt/rwtmp
errlog=/var/run/vm-protect-error errlog=/var/run/vm-protect-error
defdir=/etc/default/vms
# Function: Make user scripts immutable. # Function: Make user scripts immutable.
make_immutable() { make_immutable() {
@ -80,7 +82,6 @@ fi
# * Hashes in vms/vms.all.SHA and vms/$vmname.SHA files will be checked. # * Hashes in vms/vms.all.SHA and vms/$vmname.SHA files will be checked.
# * Remove /rw root startup files (config, usrlocal, bind-dirs). # * Remove /rw root startup files (config, usrlocal, bind-dirs).
# * Contents of vms/vms.all and vms/$vmname folders will be copied. # * Contents of vms/vms.all and vms/$vmname folders will be copied.
defdir="/etc/default/vms"
privdirs=${privdirs:-"$rw/config $rw/usrlocal $rw/bind-dirs"} privdirs=${privdirs:-"$rw/config $rw/usrlocal $rw/bind-dirs"}
if qsvc vm-boot-protect-root && is_rwonly_persistent; then if qsvc vm-boot-protect-root && is_rwonly_persistent; then
@ -159,12 +160,10 @@ if qsvc vm-boot-protect-root && is_rwonly_persistent; then
if [ -d $defdir/$vmset/rw ]; then if [ -d $defdir/$vmset/rw ]; then
echo "Copy files from $defdir/$vmset/rw" echo "Copy files from $defdir/$vmset/rw"
cp -af $defdir/$vmset/rw/* $rw cp -af $defdir/$vmset/rw/* $rw
fi
done done
# Keep configs invisible at runtime... # Keep configs invisible at runtime...
rm -rf $defdir/* rm -rf "$defdir"
fi fi