msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m54s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-10-12 18:58:03 +01:00
parent 5f36d27c62
commit 140f82829e
8 changed files with 67 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
func/cdi_4400_hardening/4430_hardening_files.sh
View File

@@ -22,17 +22,34 @@ guard_sourcing
# 0: on success
#######################################
hardening_files() {
declare var_bin="" var_binary=""
chmod 0700 "${TARGET}/etc/cron.d" "${TARGET}/etc/cron.daily" "${TARGET}/etc/cron.hourly" "${TARGET}/etc/cron.monthly" \
"${TARGET}/etc/cron.weekly"
chmod 0700 "${TARGET}/etc/sudoers.d"
chmod 0700 "${TARGET}/etc/crontab"
[[ -f "${TARGET}/etc/cron.deny" ]] && rm "${TARGET}/etc/cron.deny"
rm -f "${TARGET}/etc/issue" "${TARGET}/etc/issue.net"
install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/issue" "${TARGET}/etc/issue"
install -m 0644 -o root -g root "${VAR_SETUP_PATH}/includes/target/etc/issue.net" "${TARGET}/etc/issue.net"
install -d -m 0700 -o root -g root "${TARGET}/root/.ansible"
for var_bin in as gcc g++ cc clang; do
var_binary=$(readlink -f "${TARGET}/usr/bin/${var_bin}") || {
do_log "info" "file_only" "4430() Binary: '${var_bin}' not found, skipping."
continue
}
chmod 0700 "${var_binary}" || {
do_log "info" "file_only" "4430() Binary chmod 0700: '${var_bin}' failed, skipping."
}
done
guard_dir && return 0
}
### Prevents accidental 'unset -f'.
# shellcheck disable=SC2034
readonly -f hardening_files
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh