security-misc/usr/lib/security-misc/permission-hardening

#!/bin/bash

## Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
## See the file COPYING for copying conditions.

## https://forums.whonix.org/t/permission-hardening/8655
## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707

#set -x
set -e

exit_code=0

echo_wrapper() {
   echo "run: $@"
   "$@"
}

add_nosuid_statoverride_entry() {
  fso_to_process="${fso_without_trailing_slash}/"
  counter=0
  while read -r line; do
    true "line: $line"
    counter="$(( counter + 1 ))"
    if ! read -r file_name existing_mode owner group; then
      echo "ERROR: cannot parse line by 'stat' - line: '$line'" >&2
      continue
    fi

    ## -h file      True if file is a symbolic Link.
    ## -u file      True if file has its set-user-id bit set.
    ## -g file      True if file has its set-group-id bit set.

    if test -h "$file_name" ; then
      ## https://forums.whonix.org/t/kernel-hardening/7296/323
      true "skip symlink: $file_name"
      continue
    fi

    setuid=""
    setuid_output=""
    if test -u "$file_name" ; then
      setuid=true
      setuid_output="set-user-id"
    fi
    setguid=""
    setguid_output=""
    if test -g "$file_name"; then
      setguid=true
      setguid_output="set-group-id"
    fi

    if [ "$setuid" = "true" ] || [ "$setguid" = "true" ]; then
      string_length_of_existing_mode="${#existing_mode}"
      if [ "$string_length_of_existing_mode" = "4" ]; then
        new_mode="${existing_mode:1}"
      else
        new_mode="$existing_mode"
      fi

## Remove 'others' / 'group' execution ('chmod og-x /path/to/binary') rights for better usability?
## Make binaries such as 'su' fail closed rather than fail open if suid was removed from these?
## Are there suid or guid binaries which are still useful if suid / guid has been removed from these?
## https://forums.whonix.org/t/permission-hardening/8655/10
#       if [ "$new_mode" = "755" ]; then
#         new_mode=744
#       fi
#       if [ "$new_mode" = "754" ]; then
#         new_mode=744
#       fi
#       if [ "$new_mode" = "745" ]; then
#         new_mode=744
#       fi

      echo "INFO: $setuid_output $setguid_output found - file_name: '$file_name' | existing_mode: '$existing_mode' | new_mode: '$new_mode'"

      is_whitelisted=""
      for white_list_entry in $whitelist ; do
        if [ "$file_name" = "$white_list_entry" ]; then
          is_whitelisted="true"
          ## Stop looping through the whitelist.
          break
        fi
      done

      if [ "$is_whitelisted" = "true" ]; then
          echo "INFO: skip whitelisted: '$file_name'"
          continue
      fi

      if dpkg-statoverride --list | grep -q "$file_name"; then
        if ! dpkg-statoverride --list | grep -q "$owner $group $new_mode $file_name"; then
          echo_wrapper dpkg-statoverride --remove "$file_name"
          echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$new_mode" "$file_name"
        fi
      else
        echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$new_mode" "$file_name"
      fi
    fi

  ## /lib will hit ARG_MAX.
  ## https://forums.whonix.org/t/kernel-hardening/7296/326
  done < <( find "$fso_to_process" -print0 | xargs -I{} -0 stat -c "%n %a %U %G" {} )

  echo "INFO: fso_to_process: '$fso_to_process' | counter: '$counter'"
}

set_file_perms() {
  while read -r line; do
    if [ "$line" = "" ]; then
      continue
    fi

    if [[ "$line" =~ ^# ]]; then
      continue
    fi

    if [[ "$line" =~ [0-9a-zA-Z/] ]]; then
      true OK
    else
      exit_code=200
      echo "ERROR: cannot parse line with invalid character: $line" >&2
      continue
    fi

    if ! read -r fso mode_from_config owner group capability <<< "$line" ; then
      exit_code=201
      echo "ERROR: cannot parse line: $line" >&2
      continue
    fi

    if ! [ -e "$fso" ]; then
      echo "INFO: fso: '$fso' - does not exist. This is likely normal."
      continue
    fi

    fso_without_trailing_slash="${fso%/}"

    if [ "$mode_from_config" = "whitelist" ]; then
      whitelist+="$fso_without_trailing_slash "
      continue
    fi

    ## Use dpkg-statoverride  so permissions are not reset during upgrades.

    nosuid=""
    if [ "$mode_from_config" = "nosuid" ]; then
      nosuid="true"

      ## If mode_from_config is "nosuid" the config does not set owner and
      ## group. Therefore do not enforce owner/group check.

      add_nosuid_statoverride_entry
    else
      string_length_of_mode_from_config="${#mode_from_config}"
      if [ "$string_length_of_mode_from_config" -gt "4" ]; then
         echo "ERROR: Mode '$mode_from_config' is invalid!" >&2
         continue
      fi
      if [ "$string_length_of_mode_from_config" -lt "3" ]; then
         echo "ERROR: Mode '$mode_from_config' is invalid!" >&2
         continue
      fi

      if ! getent passwd | grep -q "^${owner}:"; then
         echo "ERROR: User '$owner' does not exist!" >&2
         continue
      fi

      if ! getent group | grep -q "^${group}:"; then
         echo "ERROR: Group '$group' does not exist!" >&2
         continue
      fi

      ## Check there is an entry for the fso.
      if dpkg-statoverride --list | grep -q "$fso_without_trailing_slash"; then
        ## There is an fso entry. Check if owner/group/mode match.
        if dpkg-statoverride --list | grep -q "$owner $group $mode_from_config $fso_without_trailing_slash"; then
          ## The owner/group/mode matches. No further action required.
          true OK
        else
          ## The owner/group/mode do not match, therefore remove and re-add the entry to update it.
          ## fso_without_trailing_slash instead of fso to prevent
          ## "dpkg-statoverride: warning: stripping trailing /"
          echo_wrapper dpkg-statoverride --remove "$fso_without_trailing_slash"
          echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$mode_from_config" "$fso_without_trailing_slash"
        fi
      else
        ## There is no fso entry. Therefore add one.
        echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$mode_from_config" "$fso_without_trailing_slash"
      fi
    fi

    if [ "$capability" = "" ]; then
      continue
    fi

    if [ "$capability" = "none" ]; then
      echo_wrapper setcap -r "$fso"
    else
      if ! capsh --print | grep "Bounding set" | grep -q "$capability"; then
         echo "ERROR: Capability '$capability' does not exist!" >&2
         continue
      fi

      echo_wrapper setcap "${capability}+ep" "$fso"
    fi
  done < "$config_file"
}

parse_config_folder() {
  shopt -s nullglob
  for config_file in /etc/permission-hardening.d/*.conf /usr/local/etc/permission-hardening.d/*.conf; do
    set_file_perms
  done
}

parse_config_folder

exit "$exit_code"