Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-02-25 04:49:51 -05:00
Code Issues Packages Projects Releases Wiki Activity

Delimit file names with null terminator

Browse Source
This commit is contained in:
Ben Grande 2024-07-22 16:01:14 +02:00
parent b7796a5334
commit 9c3566f524
No known key found for this signature in database
GPG Key ID: 00C64E14F51F9E56
1 changed files with 26 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
usr/bin/permission-hardener
View File

@ -65,18 +65,18 @@ add_nosuid_statoverride_entry() {
counter_actual=0 counter_actual=0
local dummy_line local dummy_line
while read -r dummy_line; do while IFS="" read -r -d "" dummy_line; do
true "DEBUG: test would evaluate parse" "${dummy_line}" true "DEBUG: test would evaluate parse" "${dummy_line}"
should_be_counter=$((should_be_counter + 1)) should_be_counter=$((should_be_counter + 1))
done < <(find "${fso_to_process}" -perm /u=s,g=s -print0 | xargs -I{} -0 stat -c "%n %a %U %G" {}) done < <(find "${fso_to_process}" -perm /u=s,g=s -print0 | xargs -I{} -0 stat -c "%n %a %U %G" {})
local line local line
while read -r line; do while IFS="" read -r -d "" line; do
true "line: ${line}" true "line: ${line}"
counter_actual="$((counter_actual + 1))" counter_actual="$((counter_actual + 1))"
local arr file_name existing_mode existing_owner existing_group local arr file_name existing_mode existing_owner existing_group
IFS=" " read -r -a arr <<< "${line}" read -r -a arr <<< "${line}"
file_name="${arr[0]}" file_name="${arr[0]}"
existing_mode="${arr[1]}" existing_mode="${arr[1]}"
existing_owner="${arr[2]}" existing_owner="${arr[2]}"
@ -153,7 +153,7 @@ add_nosuid_statoverride_entry() {
local is_exact_whitelisted local is_exact_whitelisted
is_exact_whitelisted="" is_exact_whitelisted=""
for white_list_entry in ${exact_white_list}; do for white_list_entry in "${exact_white_list[@]:-}"; do
if test "${file_name}" = "${white_list_entry}"; then if test "${file_name}" = "${white_list_entry}"; then
is_exact_whitelisted="true" is_exact_whitelisted="true"
## Stop looping through the whitelist. ## Stop looping through the whitelist.
@ -163,7 +163,7 @@ add_nosuid_statoverride_entry() {
local is_match_whitelisted local is_match_whitelisted
is_match_whitelisted="" is_match_whitelisted=""
for matchwhite_list_entry in ${match_white_list}; do for matchwhite_list_entry in "${match_white_list[@]:-}"; do
if echo "${file_name}" | grep --quiet --fixed-strings "${matchwhite_list_entry}"; then if echo "${file_name}" | grep --quiet --fixed-strings "${matchwhite_list_entry}"; then
is_match_whitelisted="true" is_match_whitelisted="true"
## Stop looping through the match_white_list. ## Stop looping through the match_white_list.
@ -173,7 +173,7 @@ add_nosuid_statoverride_entry() {
local is_disable_whitelisted local is_disable_whitelisted
is_disable_whitelisted="" is_disable_whitelisted=""
for disablematch_list_entry in ${disable_white_list:-}; do for disablematch_list_entry in "${disable_white_list[@]:-}"; do
if echo "${file_name}" | grep --quiet --fixed-strings "${disablematch_list_entry}"; then if echo "${file_name}" | grep --quiet --fixed-strings "${disablematch_list_entry}"; then
is_disable_whitelisted="true" is_disable_whitelisted="true"
## Stop looping through the disablewhitelist. ## Stop looping through the disablewhitelist.
@ -234,10 +234,9 @@ add_nosuid_statoverride_entry() {
## Sanity test. ## Sanity test.
if test ! "${should_be_counter}" = "${counter_actual}"; then if test ! "${should_be_counter}" = "${counter_actual}"; then
echo "INFO: fso_to_process: '${fso_to_process}' | counter_actual : '${counter_actual}'" echo "INFO: file system object (parsed/wanted): '${fso_to_process}': (${counter_actual}/${should_be_counter})"
echo "INFO: fso_to_process: '${fso_to_process}' | should_be_counter: '${should_be_counter}'" echo "ERROR: expected number of files to be parsed was not met." >&2
exit_code=202 exit_code=202
echo "ERROR: counter does not check out." >&2
fi fi
} }
@ -249,7 +248,7 @@ set_file_perms() {
continue continue
fi fi
if [[ "${line}" =~ ^# ]]; then if [[ "${line}" =~ ^\s*# ]]; then
continue continue
fi fi
@ -291,23 +290,21 @@ set_file_perms() {
local fso_without_trailing_slash local fso_without_trailing_slash
fso_without_trailing_slash="${fso%/}" fso_without_trailing_slash="${fso%/}"
if test "${mode_from_config}" = "disablewhitelist"; then ## TODO: test/add white spaces inside file name support
## TODO: test/add white spaces inside file name support case "${mode_from_config}" in
disable_white_list+="${fso} " disablewhitelist)
continue disable_white_list+=("${fso}")
fi continue
;;
if test "${mode_from_config}" = "exactwhitelist"; then exactwhitelist)
## TODO: test/add white spaces inside file name support exact_white_list+=("${fso}")
exact_white_list+="${fso} " continue
continue ;;
fi matchwhitelist)
match_white_list+=("${fso}")
if test "${mode_from_config}" = "matchwhitelist"; then continue
## TODO: test/add white spaces inside file name support ;;
match_white_list+="${fso} " esac
continue
fi
if test ! -e "${fso}"; then if test ! -e "${fso}"; then
true "INFO: fso: '${fso}' - does not exist. This is likely normal." true "INFO: fso: '${fso}' - does not exist. This is likely normal."
@ -358,7 +355,7 @@ set_file_perms() {
fi fi
local arr file_name existing_mode existing_owner existing_group local arr file_name existing_mode existing_owner existing_group
IFS=" " read -r -a arr <<< "${stat_output}" read -r -a arr <<< "${stat_output}"
file_name="${arr[0]}" file_name="${arr[0]}"
existing_mode="${arr[1]}" existing_mode="${arr[1]}"
existing_owner="${arr[2]}" existing_owner="${arr[2]}"
@ -548,7 +545,7 @@ spare() {
fi fi
local line local line
while read -r line; do while IFS="" read -r -d "" line; do
## example line: ## example line:
## root root 4755 /usr/lib/eject/dmcrypt-get-device ## root root 4755 /usr/lib/eject/dmcrypt-get-device