Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-06-25 00:40:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

refactoring

Browse source
This commit is contained in:
Patrick Schleizer 2019-12-20 02:14:45 -05:00
parent 2ed6452590
commit 39a41cc27b
No known key found for this signature in database
GPG key ID: CB8D50BB77BB3C48
1 changed files with 12 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

24
usr/lib/security-misc/permission-hardening
View file

@ -17,7 +17,7 @@ echo_wrapper() {
add_statoverride_entry() { add_statoverride_entry() {
if [ "${nosuid}" = "true" ]; then if [ "${nosuid}" = "true" ]; then
echo "file: $file" echo "fso: $fso"
while read -r line; do while read -r line; do
if ! read -r file_name existing_mode owner group; then if ! read -r file_name existing_mode owner group; then
continue continue
@ -35,9 +35,9 @@ add_statoverride_entry() {
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}" echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}"
fi fi
fi fi
done < <( stat -c "%n %a %U %G" "${file%/}/"** ) done < <( stat -c "%n %a %U %G" "${fso%/}/"** )
else else
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${mode}" "${file%/}" echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${mode}" "${fso%/}"
fi fi
} }
@ -59,14 +59,14 @@ set_file_perms() {
continue continue
fi fi
if ! read -r file mode owner group capability <<< "${line}" ; then if ! read -r fso mode owner group capability <<< "${line}" ; then
exit_code=201 exit_code=201
echo "ERROR: cannot parse line: ${line}" >&2 echo "ERROR: cannot parse line: ${line}" >&2
continue continue
fi fi
if ! [ -e "${file}" ]; then if ! [ -e "${fso}" ]; then
echo "INFO: File '${file}' does not exist!" echo "INFO: fso '${fso}' does not exist!"
continue continue
fi fi
@ -89,11 +89,11 @@ set_file_perms() {
fi fi
## The permissions should not be reset during upgrades. ## The permissions should not be reset during upgrades.
if dpkg-statoverride --list | grep -q "${file%/}"; then if dpkg-statoverride --list | grep -q "${fso%/}"; then
## If there is an entry for the file, but the owner/group/mode do not ## If there is an entry for the fso, but the owner/group/mode do not
## match, we remove and re-add the entry to update it. ## match, we remove and re-add the entry to update it.
if ! dpkg-statoverride --list | grep -q "${owner} ${group} ${mode:1} ${file%/}"; then if ! dpkg-statoverride --list | grep -q "${owner} ${group} ${mode:1} ${fso%/}"; then
echo_wrapper dpkg-statoverride --remove "${file}" echo_wrapper dpkg-statoverride --remove "${fso}"
add_statoverride_entry add_statoverride_entry
fi fi
else else
@ -102,14 +102,14 @@ set_file_perms() {
if ! [ "${capability}" = "" ]; then if ! [ "${capability}" = "" ]; then
if [ "${capability}" = "none" ]; then if [ "${capability}" = "none" ]; then
echo_wrapper setcap -r "${file}" echo_wrapper setcap -r "${fso}"
else else
if ! capsh --print | grep "Bounding set" | grep -q "${capability}"; then if ! capsh --print | grep "Bounding set" | grep -q "${capability}"; then
echo "ERROR: Capability '${capability}' does not exist!" >&2 echo "ERROR: Capability '${capability}' does not exist!" >&2
continue continue
fi fi
echo_wrapper setcap "${capability}+ep" "${file}" echo_wrapper setcap "${capability}+ep" "${fso}"
fi fi
fi fi
done < "${config_file}" done < "${config_file}"