Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

add echo wrapper

Browse Source
This commit is contained in:
Patrick Schleizer 2019-12-20 02:07:49 -05:00
parent a6988f3fb8
commit 27bfe95d25
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
usr/lib/security-misc/permission-hardening
View File

@ -11,6 +11,10 @@ config_file="/etc/permission-hardening.conf"
shopt -s globstar
echo_wrapper() {
echo "run: $@"
}
add_statoverride_entry() {
if [ "${nosuid}" = "true" ]; then
while read -r line; do
@ -23,16 +27,16 @@ add_statoverride_entry() {
if dpkg-statoverride --list | grep -q "${file_name}"; then
if ! dpkg-statoverride --list | grep -q "${owner} ${group} ${existing_mode:1} ${file_name}"; then
dpkg-statoverride --remove "${file_name}"
dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}"
echo_wrapper dpkg-statoverride --remove "${file_name}"
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}"
fi
else
dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}"
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}"
fi
fi
done < <( stat -c "%n %a %U %G" ${file%/}/** )
else
dpkg-statoverride --add --update "${owner}" "${group}" "${mode}" "${file%/}"
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${mode}" "${file%/}"
fi
}
@ -88,7 +92,7 @@ set_file_perms() {
## If there is an entry for the file, but the owner/group/mode do not
## match, we remove and re-add the entry to update it.
if ! dpkg-statoverride --list | grep -q "${owner} ${group} ${mode:1} ${file%/}"; then
dpkg-statoverride --remove "${file}"
echo_wrapper dpkg-statoverride --remove "${file}"
add_statoverride_entry
fi
else
@ -97,14 +101,14 @@ set_file_perms() {
if ! [ "${capability}" = "" ]; then
if [ "${capability}" = "none" ]; then
setcap -r "${file}"
echo_wrapper setcap -r "${file}"
else
if ! capsh --print | grep "Bounding set" | grep -q "${capability}"; then
echo "ERROR: Capability '${capability}' does not exist!" >&2
continue
fi
setcap "${capability}+ep" "${file}"
echo_wrapper setcap "${capability}+ep" "${file}"
fi
fi
done < "${config_file}"