security-misc/debian/security-misc.postinst

#!/bin/bash

## Copyright (C) 2012 - 2018 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.

if [ -f /usr/lib/helper-scripts/pre.bsh ]; then
   source /usr/lib/helper-scripts/pre.bsh
fi

set -e

true "
#####################################################################
## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@
#####################################################################
"

home_folder_access_rights_lockdown() {
   mkdir -p /var/cache/security-misc/state-files

   shopt -s nullglob

   ## Not using dotglob.
   ## touch /var/cache/security-misc/state-files//home/.Trash
   ## touch: cannot touch '/var/cache/security-misc/state-files//home/.Trash': No such file or directory

   local folder_name base_name

   for folder_name in /home/* ; do
      base_name="$(basename "$folder_name")"
      if [ -f "/var/cache/security-misc/state-files/$base_name" ]; then
         continue
      fi
      chmod o-rwx "$folder_name"
      ## Create a state-file so we do this only once.
      ## Therefore a user who will manually undo this, will not get
      ## annoyed by this being done over and over again.
      touch "/var/cache/security-misc/state-files/$base_name"
   done

   shopt -u nullglob
}

case "$1" in
    configure)
        glib-compile-schemas /usr/share/glib-2.0/schemas || true
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)
    ;;

    *)
        echo "$DPKG_MAINTSCRIPT_NAME called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

pam-auth-update --package

home_folder_access_rights_lockdown

true "INFO: debhelper beginning here."

#DEBHELPER#

true "INFO: Done with debhelper."

true "
#####################################################################
## INFO: END  : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $@
#####################################################################
"

## Explicitly "exit 0", so eventually trapped errors can be ignored.
exit 0