diff --git a/debian/security-misc.config b/debian/security-misc.config index 71726a4..95684bc 100644 --- a/debian/security-misc.config +++ b/debian/security-misc.config @@ -22,6 +22,8 @@ true " " check_migrate_permission_hardener_state() { + local modified_pkg_data_str custom_hardening_arr config_file + ## If folder /var/lib/permission-hardener (version 1) does not exist, this migration is unneeded. if [ ! -d '/var/lib/permission-hardener' ]; then return 0 @@ -82,7 +84,10 @@ check_migrate_permission_hardener_state() { '/etc/permission-hardener.d/30_default.conf' ) - readarray -t custom_hardening_arr < <(dpkg -V | awk '/permission-hardener.d/{ print $NF }') + ## This will exit non-zero if some of the packages don't exist, but we + ## don't care. The packages that *are* installed will still be scanned. + modified_pkg_data_str="$(dpkg -V security-misc user-sysmaint-split anon-apps-config)" || true + readarray -t custom_hardening_arr < <(awk '/permission-hardener.d/{ print $NF }' <<< "${modified_pkg_data_str}") ## If the above `dpkg -V` command doesn't return any permission-hardener ## related lines, the array will contain no meaningful info, just a single ## blank element at the start. Set the array to be explicitly empty in