Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

refactoring

Browse Source
This commit is contained in:
Patrick Schleizer 2019-12-20 03:00:39 -05:00
parent 640ca1d24d
commit d5ff1d6f28
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
usr/lib/security-misc/permission-hardening
View File

@ -28,13 +28,13 @@ add_statoverride_entry() {
## -u file True if file has its set-user-id bit set.
## -g file True if file has its set-group-id bit set.
if test -h "${file_name}" ; then
if test -h "$file_name" ; then
## https://forums.whonix.org/t/kernel-hardening/7296/323
true "skip symlink: ${file_name}"
true "skip symlink: $file_name"
continue
fi
if test -u "${file_name}" || test -g "${file_name}"; then
if test -u "$file_name" || test -g "$file_name"; then
string_length_of_existing_mode="${#existing_mode}"
if [ "$string_length_of_existing_mode" = "4" ]; then
new_mode="${existing_mode:1}"
@ -42,20 +42,20 @@ add_statoverride_entry() {
new_mode="${existing_mode}"
fi
echo "suid - file_name: '${file_name}' | existing_mode: '${existing_mode}' | new_mode: '$new_mode'"
echo "suid - file_name: '$file_name' | existing_mode: '$existing_mode' | new_mode: '$new_mode'"
if dpkg-statoverride --list | grep -q "${file_name}"; then
if ! dpkg-statoverride --list | grep -q "${owner} ${group} ${existing_mode:1} ${file_name}"; then
echo_wrapper dpkg-statoverride --remove "${file_name}"
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}"
if dpkg-statoverride --list | grep -q "$file_name"; then
if ! dpkg-statoverride --list | grep -q "${owner} ${group} ${existing_mode:1} $file_name"; then
echo_wrapper dpkg-statoverride --remove "$file_name"
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "$file_name"
fi
else
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}"
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "$file_name"
fi
fi
done < <( stat -c "%n %a %U %G" "${fso%/}/"** )
else
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${mode}" "${fso%/}"
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "$mode" "${fso%/}"
fi
}
@ -89,14 +89,14 @@ set_file_perms() {
fi
nosuid=""
if [ "${mode}" = "nosuid" ]; then
if [ "$mode" = "nosuid" ]; then
nosuid="true"
elif ! seq -w 000 4777 | grep -qw "${mode}"; then
echo "ERROR: Mode '${mode}' is invalid!" >&2
elif ! seq -w 000 4777 | grep -qw "$mode"; then
echo "ERROR: Mode '$mode' is invalid!" >&2
continue
fi
if [ ! "${mode}" = "nosuid" ]; then
if [ ! "$mode" = "nosuid" ]; then
if ! getent passwd | grep -q "^${owner}:"; then
echo "ERROR: User '${owner}' does not exist!" >&2
continue
@ -120,12 +120,12 @@ set_file_perms() {
add_statoverride_entry
fi
if ! [ "${capability}" = "" ]; then
if [ "${capability}" = "none" ]; then
if ! [ "$capability" = "" ]; then
if [ "$capability" = "none" ]; then
echo_wrapper setcap -r "${fso}"
else
if ! capsh --print | grep "Bounding set" | grep -q "${capability}"; then
echo "ERROR: Capability '${capability}' does not exist!" >&2
if ! capsh --print | grep "Bounding set" | grep -q "$capability"; then
echo "ERROR: Capability '$capability' does not exist!" >&2
continue
fi