Change rule to exclude nonexistent directory
This commit is contained in:
parent
8dfaa5d981
commit
73316797e3
|
@ -425,6 +425,7 @@ function set_sticky_bits {
|
||||||
}
|
}
|
||||||
|
|
||||||
function lockdown_permissions {
|
function lockdown_permissions {
|
||||||
|
# All commands owned by root
|
||||||
if [ -d /bin ]; then
|
if [ -d /bin ]; then
|
||||||
chown root:root /bin/*
|
chown root:root /bin/*
|
||||||
fi
|
fi
|
||||||
|
@ -448,6 +449,7 @@ function lockdown_permissions {
|
||||||
chmod -R +r /usr/share/${PROJECT_NAME}
|
chmod -R +r /usr/share/${PROJECT_NAME}
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
# All libraries owned by root
|
||||||
if [ -d /lib ]; then
|
if [ -d /lib ]; then
|
||||||
chown -R root:root /lib/*
|
chown -R root:root /lib/*
|
||||||
fi
|
fi
|
||||||
|
@ -461,10 +463,12 @@ function lockdown_permissions {
|
||||||
chown -R root:root /usr/lib64/*
|
chown -R root:root /usr/lib64/*
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
# sudo permissions
|
||||||
chmod 4755 /usr/bin/sudo
|
chmod 4755 /usr/bin/sudo
|
||||||
chmod 4755 /usr/lib/sudo/sudoers.so
|
chmod 4755 /usr/lib/sudo/sudoers.so
|
||||||
chown root:root /etc/sudoers
|
chown root:root /etc/sudoers
|
||||||
|
|
||||||
|
# permissions on email commands
|
||||||
if [ -f /usr/bin/procmail ]; then
|
if [ -f /usr/bin/procmail ]; then
|
||||||
chmod 6755 /usr/bin/procmail
|
chmod 6755 /usr/bin/procmail
|
||||||
fi
|
fi
|
||||||
|
@ -476,6 +480,26 @@ function lockdown_permissions {
|
||||||
fi
|
fi
|
||||||
|
|
||||||
set_sticky_bits
|
set_sticky_bits
|
||||||
|
|
||||||
|
# Create some directories to correspond with users in passwords file
|
||||||
|
if [ ! -d /var/spool/lpd ]; then
|
||||||
|
mkdir /var/spool/lpd
|
||||||
|
fi
|
||||||
|
if [ ! -d /var/spool/news ]; then
|
||||||
|
mkdir /var/spool/news
|
||||||
|
fi
|
||||||
|
if [ ! -d /var/spool/uucp ]; then
|
||||||
|
mkdir /var/spool/uucp
|
||||||
|
fi
|
||||||
|
if [ ! -d /var/list ]; then
|
||||||
|
mkdir /var/list
|
||||||
|
fi
|
||||||
|
if [ ! -d /var/lib/gnats ]; then
|
||||||
|
mkdir /var/lib/gnats
|
||||||
|
fi
|
||||||
|
if [ ! -d /var/lib/saned ]; then
|
||||||
|
mkdir /var/lib/saned
|
||||||
|
fi
|
||||||
}
|
}
|
||||||
|
|
||||||
function disable_core_dumps {
|
function disable_core_dumps {
|
||||||
|
|
|
@ -1,5 +1,5 @@
|
||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
|
|
||||||
if [ $(pwck -rq | wc -l ) -ne 0 ];then
|
if [ $(pwck -r | sed '/nonexist/d' | sed '/\/home\//d' | sed '/\/run\//d' | sed '/no changes/d' | wc -l ) -ne 0 ];then
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
Loading…
Reference in New Issue