Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-13 20:39:30 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix, re-enforce nosuid even if changed on the disk

Browse Source
This commit is contained in:
Patrick Schleizer 2019-12-20 10:21:27 -05:00
parent e36868e675
commit 4cfdf2c65b
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
usr/lib/security-misc/permission-hardening
View File

@ -110,14 +110,11 @@ add_nosuid_statoverride_entry() {
echo "INFO: $setuid_output $setguid_output found - file_name: '$file_name' | existing_mode: '$existing_mode' | new_mode: '$new_mode'"
if dpkg-statoverride --list | grep -q "$file_name"; then
if ! dpkg-statoverride --list | grep -q "$owner $group $new_mode $file_name"; then
echo_wrapper dpkg-statoverride --remove "$file_name"
echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$new_mode" "$file_name"
fi
else
echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$new_mode" "$file_name"
fi
## No need to check "dpkg-statoverride --list" for existing entries.
## If existing_mode was correct already, we would not have reached this point.
## Since existing_mode is incorrect, remove from dpkg-statoverride and re-add.
echo_wrapper dpkg-statoverride --remove "$file_name" || true
echo_wrapper dpkg-statoverride --add --update "$owner" "$group" "$new_mode" "$file_name"
fi
## /lib will hit ARG_MAX.