security-misc/usr/lib/security-misc/permission-hardening

#!/bin/bash

## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.

#set -x

exit_code=0

config_file="/etc/permission-hardening.conf"

shopt -s globstar

echo_wrapper() {
   echo "run: $@"
   ## TODO
   #"$@"
}

add_statoverride_entry() {
  if [ "${nosuid}" = "true" ]; then
    echo "fso: $fso"
    while read -r line; do
      if ! read -r file_name existing_mode owner group; then
        continue
      fi

      ## -h file      True if file is a symbolic Link.
      ## -u file      True if file has its set-user-id bit set.
      ## -g file      True if file has its set-group-id bit set.

      if test -h "$file_name" ; then
        ## https://forums.whonix.org/t/kernel-hardening/7296/323
        true "skip symlink: $file_name"
        continue
      fi

      if test -u "$file_name" || test -g "$file_name"; then
        string_length_of_existing_mode="${#existing_mode}"
        if [ "$string_length_of_existing_mode" = "4" ]; then
          new_mode="${existing_mode:1}"
        else
          new_mode="$existing_mode"
        fi

        echo "suid - file_name: '$file_name' | existing_mode: '$existing_mode' | new_mode: '$new_mode'"

        if dpkg-statoverride --list | grep -q "$file_name"; then
          if ! dpkg-statoverride --list | grep -q "$owner $group $new_mode $file_name"; then
            echo_wrapper dpkg-statoverride --remove "$file_name"
            echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$new_mode" "$file_name"
          fi
        else
          echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$new_mode" "$file_name"
        fi
      fi
    done < <( stat -c "%n %a %U %G" "${fso%/}/"** )
  else
    echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$mode_from_config" "${fso%/}"
  fi
}

set_file_perms() {
  while read -r line; do
    if [ "$line" = "" ]; then
      continue
    fi

    if [[ "$line" =~ ^# ]]; then
      continue
    fi

    if [[ "$line" =~ [0-9a-zA-Z/] ]]; then
      true OK
    else
      exit_code=200
      echo "ERROR: cannot parse line with invalid character: $line" >&2
      continue
    fi

    if ! read -r fso mode_from_config owner group capability <<< "$line" ; then
      exit_code=201
      echo "ERROR: cannot parse line: $line" >&2
      continue
    fi

    if ! [ -e "${fso}" ]; then
      echo "INFO: fso '${fso}' does not exist!"
      continue
    fi

    nosuid=""
    if [ "$mode_from_config" = "nosuid" ]; then
      nosuid="true"
    elif ! seq -w 000 4777 | grep -qw "$mode_from_config"; then
      echo "ERROR: Mode '$mode_from_config' is invalid!" >&2
      continue
    fi

    if [ "$mode_from_config" = "nosuid" ]; then
      ## If mode_from_config is "nosuid" the config does not set owner and
      ## group. Therefore do not enforce owner/group check.
      true OK
    else
      if ! getent passwd | grep -q "^${owner}:"; then
         echo "ERROR: User '$owner' does not exist!" >&2
         continue
      fi

      if ! getent group | grep -q "^${group}:"; then
         echo "ERROR: Group '$group' does not exist!" >&2
         continue
      fi
    fi

    ## Use dpkg-statoverride  so permissions are not reset during upgrades.

    if dpkg-statoverride --list | grep -q "${fso%/}"; then
      ## If there is an entry for the fso, but the owner/group/mode do not
      ## match, we remove and re-add the entry to update it.
      if ! dpkg-statoverride --list | grep -q "$owner $group $mode_from_config ${fso%/}"; then
        echo_wrapper dpkg-statoverride --remove "${fso}"
        add_statoverride_entry
      fi
    else
      add_statoverride_entry
    fi

    if ! [ "$capability" = "" ]; then
      if [ "$capability" = "none" ]; then
        echo_wrapper setcap -r "${fso}"
      else
        if ! capsh --print | grep "Bounding set" | grep -q "$capability"; then
           echo "ERROR: Capability '$capability' does not exist!" >&2
           continue
        fi

        echo_wrapper setcap "${capability}+ep" "${fso}"
      fi
    fi
  done < "${config_file}"
}

set_file_perms

exit "$exit_code"