Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-02-09 01:58:32 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix disablewhitelist feature

Browse Source
This commit is contained in:
Patrick Schleizer 2019-12-23 02:35:13 -05:00
parent 47ddcad0c0
commit f8f2e6c704
No known key found for this signature in database
GPG Key ID: CB8D50BB77BB3C48
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
etc/permission-hardening.d/30_default.conf
View File

@ -17,6 +17,8 @@
# SUID disablewhitelist # SUID disablewhitelist
###################################################################### ######################################################################
#/utempter/utempter disablewhitelist
###################################################################### ######################################################################
# SUID exact match whitelist # SUID exact match whitelist
###################################################################### ######################################################################

3
usr/lib/security-misc/permission-hardening
View File

@ -170,7 +170,7 @@ add_nosuid_statoverride_entry() {
local is_disable_whitelisted local is_disable_whitelisted
is_disable_whitelisted="" is_disable_whitelisted=""
for disablematch_list_entry in $disable_white_list ; do for disablematch_list_entry in $disable_white_list ; do
if [ "$file_name" = "$disablematch_list_entry" ]; then if echo "$file_name" | grep -q "$disablematch_list_entry" ; then
is_disable_whitelisted="true" is_disable_whitelisted="true"
## Stop looping through the disablewhitelist. ## Stop looping through the disablewhitelist.
break break
@ -179,7 +179,6 @@ add_nosuid_statoverride_entry() {
if [ "$is_disable_whitelisted" = "true" ]; then if [ "$is_disable_whitelisted" = "true" ]; then
echo "INFO: white list disabled - $setuid_output $setsgid_output found - file_name: '$file_name' | existing_mode: '$existing_mode'" echo "INFO: white list disabled - $setuid_output $setsgid_output found - file_name: '$file_name' | existing_mode: '$existing_mode'"
continue
else else
if [ "$is_exact_whitelisted" = "true" ]; then if [ "$is_exact_whitelisted" = "true" ]; then
echo "INFO: SKIP whitelisted - $setuid_output $setsgid_output found - file_name: '$file_name' | existing_mode: '$existing_mode'" echo "INFO: SKIP whitelisted - $setuid_output $setsgid_output found - file_name: '$file_name' | existing_mode: '$existing_mode'"