Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-25 21:39:25 -05:00
Code Issues Packages Projects Releases Wiki Activity

do not remove suid from whitelisted binaries ever

Browse Source 
https://forums.whonix.org/t/permission-hardening/8655/13
This commit is contained in:
Patrick Schleizer 2019-12-20 08:13:23 -05:00
parent d5f1bd8dd2
commit 6d30e3b4a2
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
2 changed files with 28 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
etc/permission-hardening.d/30_default.conf
View File

@ -13,6 +13,15 @@
## To remove all SUID/SGID binaries in a directory, you can use the "nosuid"
## argument.
## SUID whitelist.
/usr/bin/sudo whitelist
/usr/bin/bwrap whitelist
/usr/lib/policykit-1/polkit-agent-helper-1 whitelist
/usr/lib/dbus-1.0/dbus-daemon-launch-helper whitelist
/usr/lib/spice-gtk/spice-client-glib-usb-acl-helper whitelist
/usr/lib/x86_64-linux-gnu/utempter/utempter whitelist
## Permission hardening.
/home/ 0755 root root
/home/user/ 0700 user user
/root/ 0700 root root
@ -41,11 +50,3 @@
/usr/local/lib/ nosuid
/usr/local/lib32/ nosuid
/usr/local/lib64/ nosuid
## SUID whitelist.
/usr/bin/sudo 4755 root root
/usr/bin/bwrap 4755 root root
/usr/lib/policykit-1/polkit-agent-helper-1 4755 root root
/usr/lib/dbus-1.0/dbus-daemon-launch-helper 4754 root messagebus
/usr/lib/spice-gtk/spice-client-glib-usb-acl-helper 4755 root root
/usr/lib/x86_64-linux-gnu/utempter/utempter 2755 root utmp

19
usr/lib/security-misc/permission-hardening
View File

@ -69,6 +69,20 @@ add_nosuid_statoverride_entry() {
echo "INFO: $setuid_output $setguid_output found - file_name: '$file_name' | existing_mode: '$existing_mode' | new_mode: '$new_mode'"
is_whitelisted=""
for white_list_entry in $whitelist ; do
if [ "$file_name" = "$white_list_entry" ]; then
is_whitelisted="true"
## Stop looping through the whitelist.
break
fi
done
if [ "$is_whitelisted" = "true" ]; then
echo "INFO: skip whitelisted: '$file_name'"
continue
fi
if dpkg-statoverride --list | grep -q "$file_name"; then
if ! dpkg-statoverride --list | grep -q "$owner $group $new_mode $file_name"; then
echo_wrapper dpkg-statoverride --remove "$file_name"
@ -115,6 +129,11 @@ set_file_perms() {
fso_without_trailing_slash="${fso%/}"
if [ "$mode_from_config" = "whitelist" ]; then
whitelist+="$fso_without_trailing_slash "
continue
fi
## Use dpkg-statoverride so permissions are not reset during upgrades.
nosuid=""