Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-13 10:39:26 -05:00
Code Issues Packages Projects Releases Wiki Activity

improve output

Browse Source 
https://github.com/Kicksecure/security-misc/issues/172
This commit is contained in:
Patrick Schleizer 2024-02-26 08:07:29 -05:00
parent d8f5376c4f
commit 2d1d1b246f
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
usr/libexec/security-misc/hide-hardware-info
View File

@ -6,7 +6,12 @@
set -e set -e
run_cmd() { run_cmd() {
echo "INFO: executing: $@" echo "INFO: normal executing : $@"
"$@"
}
run_cmd_whitelist() {
echo "INFO: whitelist executing: $@"
"$@" "$@"
} }
@ -43,9 +48,9 @@ create_whitelist() {
## Changing the permissions of /sys recursively ## Changing the permissions of /sys recursively
## causes errors as the permissions of /sys/kernel/debug ## causes errors as the permissions of /sys/kernel/debug
## and /sys/fs/cgroup cannot be changed. ## and /sys/fs/cgroup cannot be changed.
run_cmd chgrp -fR "${1}" "${whitelist_path}" || true run_cmd_whitelist chgrp -fR "${1}" "${whitelist_path}" || true
run_cmd chmod o-rwx "${whitelist_path}" run_cmd_whitelist chmod o-rwx "${whitelist_path}"
else else
echo "ERROR: The ${1} group does not exist, the ${1} whitelist was not created." echo "ERROR: The ${1} group does not exist, the ${1} whitelist was not created."
fi fi
@ -67,17 +72,16 @@ do
if [ "${sysfs_whitelist}" = "1" ]; then if [ "${sysfs_whitelist}" = "1" ]; then
create_whitelist sysfs create_whitelist sysfs
else else
echo "INFO: The sysfs whitelist is not enabled. Some things may not work properly. Full sysfs hardening..."
run_cmd chmod og-rwx /sys run_cmd chmod og-rwx /sys
echo "INFO: The sysfs whitelist is not enabled. Some things may not work properly."
fi fi
fi fi
elif [ "${i}" = "/proc/cpuinfo" ]; then elif [ "${i}" = "/proc/cpuinfo" ]; then
## Whitelist for /proc/cpuinfo.
if [ "${cpuinfo_whitelist}" = "1" ]; then if [ "${cpuinfo_whitelist}" = "1" ]; then
create_whitelist cpuinfo create_whitelist cpuinfo
else else
echo "INFO: The cpuinfo whitelist is not enabled. Some things may not work properly. Full cpuinfo hardening..."
run_cmd chmod og-rwx /proc/cpuinfo run_cmd chmod og-rwx /proc/cpuinfo
echo "INFO: The cpuinfo whitelist is not enabled. Some things may not work properly."
fi fi
else else
run_cmd chmod og-rwx "${i}" run_cmd chmod og-rwx "${i}"