Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-26 09:19:25 -05:00
Code Issues Packages Projects Releases Wiki Activity

Allow access to /sys/fs for polkit

Browse Source
This commit is contained in:
Daniel Winzen 2024-02-21 20:37:34 +01:00
parent c0f98b05b6
commit 3bc1765dbb
No known key found for this signature in database
GPG Key ID: 222FCC3F35C41077
1 changed files with 17 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
usr/libexec/security-misc/hide-hardware-info
View File

@ -80,6 +80,23 @@ do
fi fi
done done
## restrict permissions on everything but
## what is needed
for i in /sys/* /sys/fs/*
do
## Using '|| true':
## https://github.com/Kicksecure/security-misc/pull/108
if [ "${sysfs_whitelist}" = "1" ]; then
chmod o-rwx "${i}" || true
else
chmod og-rwx "${i}" || true
fi
done
## polkit needs stat access to /sys/fs/cgroup
## to function properly
chmod o+rx /sys /sys/fs
## on SELinux systems, at least /sys/fs/selinux ## on SELinux systems, at least /sys/fs/selinux
## must be visible to unprivileged users, else ## must be visible to unprivileged users, else
## SELinux userspace utilities will not function ## SELinux userspace utilities will not function
@ -88,18 +105,6 @@ if [ -d /sys/fs/selinux ]; then
echo "INFO: SELinux detected because folder /sys/fs/selinux exists. See also:" echo "INFO: SELinux detected because folder /sys/fs/selinux exists. See also:"
echo "https://www.kicksecure.com/wiki/Security-misc#selinux" echo "https://www.kicksecure.com/wiki/Security-misc#selinux"
if [ "${selinux}" = "1" ]; then if [ "${selinux}" = "1" ]; then
## restrict permissions on everything but
## what is needed
for i in /sys/* /sys/fs/*
do
## Using '|| true':
## https://github.com/Kicksecure/security-misc/pull/108
if [ "${sysfs_whitelist}" = "1" ]; then
chmod o-rwx "${i}" || true
else
chmod og-rwx "${i}" || true
fi
done
chmod o+rx /sys /sys/fs /sys/fs/selinux chmod o+rx /sys /sys/fs /sys/fs/selinux
echo "INFO: SELinux mode enabled. Restrictions loosened slightly in order to allow userspace utilities to function." echo "INFO: SELinux mode enabled. Restrictions loosened slightly in order to allow userspace utilities to function."
else else