Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-06-25 09:30:29 -04:00
Code Issues Projects Releases Packages Wiki Activity

add echo wrapper

Browse source
This commit is contained in:
Patrick Schleizer 2019-12-20 02:07:49 -05:00
parent a6988f3fb8
commit 27bfe95d25
No known key found for this signature in database
GPG key ID: CB8D50BB77BB3C48
1 changed files with 11 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

18
usr/lib/security-misc/permission-hardening
View file

@ -11,6 +11,10 @@ config_file="/etc/permission-hardening.conf"
shopt -s globstar shopt -s globstar
echo_wrapper() {
echo "run: $@"
}
add_statoverride_entry() { add_statoverride_entry() {
if [ "${nosuid}" = "true" ]; then if [ "${nosuid}" = "true" ]; then
while read -r line; do while read -r line; do
@ -23,16 +27,16 @@ add_statoverride_entry() {
if dpkg-statoverride --list | grep -q "${file_name}"; then if dpkg-statoverride --list | grep -q "${file_name}"; then
if ! dpkg-statoverride --list | grep -q "${owner} ${group} ${existing_mode:1} ${file_name}"; then if ! dpkg-statoverride --list | grep -q "${owner} ${group} ${existing_mode:1} ${file_name}"; then
dpkg-statoverride --remove "${file_name}" echo_wrapper dpkg-statoverride --remove "${file_name}"
dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}" echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}"
fi fi
else else
dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}" echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}"
fi fi
fi fi
done < <( stat -c "%n %a %U %G" ${file%/}/** ) done < <( stat -c "%n %a %U %G" ${file%/}/** )
else else
dpkg-statoverride --add --update "${owner}" "${group}" "${mode}" "${file%/}" echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${mode}" "${file%/}"
fi fi
} }
@ -88,7 +92,7 @@ set_file_perms() {
## If there is an entry for the file, but the owner/group/mode do not ## If there is an entry for the file, but the owner/group/mode do not
## match, we remove and re-add the entry to update it. ## match, we remove and re-add the entry to update it.
if ! dpkg-statoverride --list | grep -q "${owner} ${group} ${mode:1} ${file%/}"; then if ! dpkg-statoverride --list | grep -q "${owner} ${group} ${mode:1} ${file%/}"; then
dpkg-statoverride --remove "${file}" echo_wrapper dpkg-statoverride --remove "${file}"
add_statoverride_entry add_statoverride_entry
fi fi
else else
@ -97,14 +101,14 @@ set_file_perms() {
if ! [ "${capability}" = "" ]; then if ! [ "${capability}" = "" ]; then
if [ "${capability}" = "none" ]; then if [ "${capability}" = "none" ]; then
setcap -r "${file}" echo_wrapper setcap -r "${file}"
else else
if ! capsh --print | grep "Bounding set" | grep -q "${capability}"; then if ! capsh --print | grep "Bounding set" | grep -q "${capability}"; then
echo "ERROR: Capability '${capability}' does not exist!" >&2 echo "ERROR: Capability '${capability}' does not exist!" >&2
continue continue
fi fi
setcap "${capability}+ep" "${file}" echo_wrapper setcap "${capability}+ep" "${file}"
fi fi
fi fi
done < "${config_file}" done < "${config_file}"