Change rule to exclude nonexistent directory

This commit is contained in:
Bob Mottram 2016-11-30 14:38:28 +00:00
parent 8dfaa5d981
commit 73316797e3
2 changed files with 25 additions and 1 deletions

View File

@ -425,6 +425,7 @@ function set_sticky_bits {
} }
function lockdown_permissions { function lockdown_permissions {
# All commands owned by root
if [ -d /bin ]; then if [ -d /bin ]; then
chown root:root /bin/* chown root:root /bin/*
fi fi
@ -448,6 +449,7 @@ function lockdown_permissions {
chmod -R +r /usr/share/${PROJECT_NAME} chmod -R +r /usr/share/${PROJECT_NAME}
fi fi
# All libraries owned by root
if [ -d /lib ]; then if [ -d /lib ]; then
chown -R root:root /lib/* chown -R root:root /lib/*
fi fi
@ -461,10 +463,12 @@ function lockdown_permissions {
chown -R root:root /usr/lib64/* chown -R root:root /usr/lib64/*
fi fi
# sudo permissions
chmod 4755 /usr/bin/sudo chmod 4755 /usr/bin/sudo
chmod 4755 /usr/lib/sudo/sudoers.so chmod 4755 /usr/lib/sudo/sudoers.so
chown root:root /etc/sudoers chown root:root /etc/sudoers
# permissions on email commands
if [ -f /usr/bin/procmail ]; then if [ -f /usr/bin/procmail ]; then
chmod 6755 /usr/bin/procmail chmod 6755 /usr/bin/procmail
fi fi
@ -476,6 +480,26 @@ function lockdown_permissions {
fi fi
set_sticky_bits set_sticky_bits
# Create some directories to correspond with users in passwords file
if [ ! -d /var/spool/lpd ]; then
mkdir /var/spool/lpd
fi
if [ ! -d /var/spool/news ]; then
mkdir /var/spool/news
fi
if [ ! -d /var/spool/uucp ]; then
mkdir /var/spool/uucp
fi
if [ ! -d /var/list ]; then
mkdir /var/list
fi
if [ ! -d /var/lib/gnats ]; then
mkdir /var/lib/gnats
fi
if [ ! -d /var/lib/saned ]; then
mkdir /var/lib/saned
fi
} }
function disable_core_dumps { function disable_core_dumps {

View File

@ -1,5 +1,5 @@
#!/bin/bash #!/bin/bash
if [ $(pwck -rq | wc -l ) -ne 0 ];then if [ $(pwck -r | sed '/nonexist/d' | sed '/\/home\//d' | sed '/\/run\//d' | sed '/no changes/d' | wc -l ) -ne 0 ];then
exit 1 exit 1
fi fi