Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

refactoring

Browse Source
This commit is contained in:
Patrick Schleizer 2019-12-20 03:00:39 -05:00
parent 640ca1d24d
commit d5ff1d6f28
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
1 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
usr/lib/security-misc/permission-hardening
View File

@ -28,13 +28,13 @@ add_statoverride_entry() {
## -u file True if file has its set-user-id bit set. ## -u file True if file has its set-user-id bit set.
## -g file True if file has its set-group-id bit set. ## -g file True if file has its set-group-id bit set.
if test -h "${file_name}" ; then if test -h "$file_name" ; then
## https://forums.whonix.org/t/kernel-hardening/7296/323 ## https://forums.whonix.org/t/kernel-hardening/7296/323
true "skip symlink: ${file_name}" true "skip symlink: $file_name"
continue continue
fi fi
if test -u "${file_name}" || test -g "${file_name}"; then if test -u "$file_name" || test -g "$file_name"; then
string_length_of_existing_mode="${#existing_mode}" string_length_of_existing_mode="${#existing_mode}"
if [ "$string_length_of_existing_mode" = "4" ]; then if [ "$string_length_of_existing_mode" = "4" ]; then
new_mode="${existing_mode:1}" new_mode="${existing_mode:1}"
@ -42,20 +42,20 @@ add_statoverride_entry() {
new_mode="${existing_mode}" new_mode="${existing_mode}"
fi fi
echo "suid - file_name: '${file_name}' | existing_mode: '${existing_mode}' | new_mode: '$new_mode'" echo "suid - file_name: '$file_name' | existing_mode: '$existing_mode' | new_mode: '$new_mode'"
if dpkg-statoverride --list | grep -q "${file_name}"; then if dpkg-statoverride --list | grep -q "$file_name"; then
if ! dpkg-statoverride --list | grep -q "${owner} ${group} ${existing_mode:1} ${file_name}"; then if ! dpkg-statoverride --list | grep -q "${owner} ${group} ${existing_mode:1} $file_name"; then
echo_wrapper dpkg-statoverride --remove "${file_name}" echo_wrapper dpkg-statoverride --remove "$file_name"
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}" echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "$file_name"
fi fi
else else
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "${file_name}" echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${existing_mode:1}" "$file_name"
fi fi
fi fi
done < <( stat -c "%n %a %U %G" "${fso%/}/"** ) done < <( stat -c "%n %a %U %G" "${fso%/}/"** )
else else
echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "${mode}" "${fso%/}" echo_wrapper dpkg-statoverride --add --update "${owner}" "${group}" "$mode" "${fso%/}"
fi fi
} }
@ -89,14 +89,14 @@ set_file_perms() {
fi fi
nosuid="" nosuid=""
if [ "${mode}" = "nosuid" ]; then if [ "$mode" = "nosuid" ]; then
nosuid="true" nosuid="true"
elif ! seq -w 000 4777 | grep -qw "${mode}"; then elif ! seq -w 000 4777 | grep -qw "$mode"; then
echo "ERROR: Mode '${mode}' is invalid!" >&2 echo "ERROR: Mode '$mode' is invalid!" >&2
continue continue
fi fi
if [ ! "${mode}" = "nosuid" ]; then if [ ! "$mode" = "nosuid" ]; then
if ! getent passwd | grep -q "^${owner}:"; then if ! getent passwd | grep -q "^${owner}:"; then
echo "ERROR: User '${owner}' does not exist!" >&2 echo "ERROR: User '${owner}' does not exist!" >&2
continue continue
@ -120,12 +120,12 @@ set_file_perms() {
add_statoverride_entry add_statoverride_entry
fi fi
if ! [ "${capability}" = "" ]; then if ! [ "$capability" = "" ]; then
if [ "${capability}" = "none" ]; then if [ "$capability" = "none" ]; then
echo_wrapper setcap -r "${fso}" echo_wrapper setcap -r "${fso}"
else else
if ! capsh --print | grep "Bounding set" | grep -q "${capability}"; then if ! capsh --print | grep "Bounding set" | grep -q "$capability"; then
echo "ERROR: Capability '${capability}' does not exist!" >&2 echo "ERROR: Capability '$capability' does not exist!" >&2
continue continue
fi fi