Change rule to exclude nonexistent directory
This commit is contained in:
parent
8dfaa5d981
commit
73316797e3
|
@ -425,6 +425,7 @@ function set_sticky_bits {
|
|||
}
|
||||
|
||||
function lockdown_permissions {
|
||||
# All commands owned by root
|
||||
if [ -d /bin ]; then
|
||||
chown root:root /bin/*
|
||||
fi
|
||||
|
@ -448,6 +449,7 @@ function lockdown_permissions {
|
|||
chmod -R +r /usr/share/${PROJECT_NAME}
|
||||
fi
|
||||
|
||||
# All libraries owned by root
|
||||
if [ -d /lib ]; then
|
||||
chown -R root:root /lib/*
|
||||
fi
|
||||
|
@ -461,10 +463,12 @@ function lockdown_permissions {
|
|||
chown -R root:root /usr/lib64/*
|
||||
fi
|
||||
|
||||
# sudo permissions
|
||||
chmod 4755 /usr/bin/sudo
|
||||
chmod 4755 /usr/lib/sudo/sudoers.so
|
||||
chown root:root /etc/sudoers
|
||||
|
||||
# permissions on email commands
|
||||
if [ -f /usr/bin/procmail ]; then
|
||||
chmod 6755 /usr/bin/procmail
|
||||
fi
|
||||
|
@ -476,6 +480,26 @@ function lockdown_permissions {
|
|||
fi
|
||||
|
||||
set_sticky_bits
|
||||
|
||||
# Create some directories to correspond with users in passwords file
|
||||
if [ ! -d /var/spool/lpd ]; then
|
||||
mkdir /var/spool/lpd
|
||||
fi
|
||||
if [ ! -d /var/spool/news ]; then
|
||||
mkdir /var/spool/news
|
||||
fi
|
||||
if [ ! -d /var/spool/uucp ]; then
|
||||
mkdir /var/spool/uucp
|
||||
fi
|
||||
if [ ! -d /var/list ]; then
|
||||
mkdir /var/list
|
||||
fi
|
||||
if [ ! -d /var/lib/gnats ]; then
|
||||
mkdir /var/lib/gnats
|
||||
fi
|
||||
if [ ! -d /var/lib/saned ]; then
|
||||
mkdir /var/lib/saned
|
||||
fi
|
||||
}
|
||||
|
||||
function disable_core_dumps {
|
||||
|
|
|
@ -1,5 +1,5 @@
|
|||
#!/bin/bash
|
||||
|
||||
if [ $(pwck -rq | wc -l ) -ne 0 ];then
|
||||
if [ $(pwck -r | sed '/nonexist/d' | sed '/\/home\//d' | sed '/\/run\//d' | sed '/no changes/d' | wc -l ) -ne 0 ];then
|
||||
exit 1
|
||||
fi
|
||||
|
|
Loading…
Reference in New Issue