Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-06-07 10:22:43 -04:00
Code Issues Projects Releases Packages Wiki Activity

refactoring

Browse source
This commit is contained in:
Patrick Schleizer 2019-12-21 04:33:03 -05:00
parent 0c5848494b
commit 315ce86b9a
No known key found for this signature in database
GPG key ID: CB8D50BB77BB3C48
1 changed files with 36 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

66
usr/lib/security-misc/remount-secure
View file

@ -37,83 +37,89 @@ fi
exit_code=0 exit_code=0
home() { _home() {
funcname_sanatized="$(echo "$FUNCNAME" | str_replace "_" "/")"
if [ -e "/var/run/remount-secure/${FUNCNAME}" ]; then if [ -e "/var/run/remount-secure/${FUNCNAME}" ]; then
return 0 return 0
fi fi
new_mount_options="nosuid,nodev${noexec_maybe}" new_mount_options="nosuid,nodev${noexec_maybe}"
if mount | grep /home | grep -q "$new_mount_options" ; then if mount | grep "$funcname_sanatized" | grep -q "$new_mount_options" ; then
echo "INFO: $FUNCNAME has already intended mount options." echo "INFO: $funcname_sanatized has already intended mount options."
return 0 return 0
fi fi
mount -o "remount,${new_mount_options}" /home || exit_code=2 mount -o "remount,${new_mount_options}" "$funcname_sanatized" || exit_code=2
touch "/var/run/remount-secure/${FUNCNAME}" touch "/var/run/remount-secure/${FUNCNAME}"
} }
run() { _run() {
funcname_sanatized="$(echo "$FUNCNAME" | str_replace "_" "/")"
if [ -e "/var/run/remount-secure/${FUNCNAME}" ]; then if [ -e "/var/run/remount-secure/${FUNCNAME}" ]; then
return 0 return 0
fi fi
## https://lists.freedesktop.org/archives/systemd-devel/2015-February/028456.html ## https://lists.freedesktop.org/archives/systemd-devel/2015-February/028456.html
new_mount_options="nosuid,nodev${noexec_maybe}" new_mount_options="nosuid,nodev${noexec_maybe}"
if mount | grep /run | grep -q "$new_mount_options" ; then if mount | grep "$funcname_sanatized" | grep -q "$new_mount_options" ; then
echo "INFO: $FUNCNAME has already intended mount options." echo "INFO: $funcname_sanatized has already intended mount options."
return 0 return 0
fi fi
mount -o "remount,${new_mount_options}" /run || exit_code=3 mount -o "remount,${new_mount_options}" "$funcname_sanatized" || exit_code=3
touch "/var/run/remount-secure/${FUNCNAME}" touch "/var/run/remount-secure/${FUNCNAME}"
} }
shm() { _dev_shm() {
funcname_sanatized="$(echo "$FUNCNAME" | str_replace "_" "/")"
if [ -e "/var/run/remount-secure/${FUNCNAME}" ]; then if [ -e "/var/run/remount-secure/${FUNCNAME}" ]; then
return 0 return 0
fi fi
new_mount_options="nosuid,nodev${noexec_maybe}" new_mount_options="nosuid,nodev${noexec_maybe}"
if mount | grep /dev/shm | grep -q "$new_mount_options" ; then if mount | grep "$funcname_sanatized" | grep -q "$new_mount_options" ; then
echo "INFO: $FUNCNAME has already intended mount options." echo "INFO: $funcname_sanatized has already intended mount options."
return 0 return 0
fi fi
mount -o "remount,${new_mount_options}" /dev/shm || exit_code=4 mount -o "remount,${new_mount_options}" "$funcname_sanatized" || exit_code=4
touch "/var/run/remount-secure/${FUNCNAME}" touch "/var/run/remount-secure/${FUNCNAME}"
} }
tmp() { _tmp() {
funcname_sanatized="$(echo "$FUNCNAME" | str_replace "_" "/")"
if [ -e "/var/run/remount-secure/${FUNCNAME}" ]; then if [ -e "/var/run/remount-secure/${FUNCNAME}" ]; then
return 0 return 0
fi fi
new_mount_options="nosuid,nodev${noexec_maybe}" new_mount_options="nosuid,nodev${noexec_maybe}"
if mount | grep /tmp | grep -q "$new_mount_options" ; then if mount | grep "$funcname_sanatized" | grep -q "$new_mount_options" ; then
echo "INFO: $FUNCNAME has already intended mount options." echo "INFO: $funcname_sanatized has already intended mount options."
return 0 return 0
fi fi
mount -o "$new_mount_options" --bind /tmp /tmp || exit_code=5 mount -o "$new_mount_options" --bind "$funcname_sanatized" "$funcname_sanatized" || exit_code=5
touch "/var/run/remount-secure/${FUNCNAME}" touch "/var/run/remount-secure/${FUNCNAME}"
} }
securityfs() { _sys_kernel_security() {
funcname_sanatized="$(echo "$FUNCNAME" | str_replace "_" "/")"
if [ -e "/var/run/remount-secure/${FUNCNAME}" ]; then if [ -e "/var/run/remount-secure/${FUNCNAME}" ]; then
return 0 return 0
fi fi
new_mount_options="nosuid,nodev${noexec_maybe}" new_mount_options="nosuid,nodev${noexec_maybe}"
if mount | grep /sys/kernel/security | grep -q "$new_mount_options" ; then if mount | grep "$funcname_sanatized" | grep -q "$new_mount_options" ; then
echo "INFO: $FUNCNAME has already intended mount options." echo "INFO: $funcname_sanatized has already intended mount options."
return 0 return 0
fi fi
mount -o "$new_mount_options" --bind /sys/kernel/security /sys/kernel/security || exit_code=6 mount -o "$new_mount_options" --bind "$funcname_sanatized" "$funcname_sanatized" || exit_code=6
touch "/var/run/remount-secure/${FUNCNAME}" touch "/var/run/remount-secure/${FUNCNAME}"
} }
lib() { _lib() {
funcname_sanatized="$(echo "$FUNCNAME" | str_replace "_" "/")"
if [ -e "/var/run/remount-secure/${FUNCNAME}" ]; then if [ -e "/var/run/remount-secure/${FUNCNAME}" ]; then
return 0 return 0
fi fi
## Not using noexec on /lib. ## Not using noexec on /lib.
new_mount_options="nosuid,nodev" new_mount_options="nosuid,nodev"
if mount | grep /lib | grep -q "$new_mount_options" ; then if mount | grep "$funcname_sanatized" | grep -q "$new_mount_options" ; then
echo "INFO: $FUNCNAME has already intended mount options." echo "INFO: $funcname_sanatized has already intended mount options."
return 0 return 0
fi fi
mount -o "$new_mount_options" --bind /lib /lib || exit_code=7 mount -o "$new_mount_options" --bind "$funcname_sanatized" "$funcname_sanatized" || exit_code=7
touch "/var/run/remount-secure/${FUNCNAME}" touch "/var/run/remount-secure/${FUNCNAME}"
} }
@ -122,12 +128,12 @@ end() {
} }
main() { main() {
home "$@" _home "$@"
run "$@" _run "$@"
shm "$@" _dev_shm "$@"
tmp "$@" _tmp "$@"
securityfs "$@" _sys_kernel_security "$@"
lib "$@" _lib "$@"
end "$@" end "$@"
} }