Change rule to exclude nonexistent directory

This commit is contained in:
Bob Mottram 2016-11-30 14:38:28 +00:00
parent 8dfaa5d981
commit 73316797e3
2 changed files with 25 additions and 1 deletions

View File

@ -425,6 +425,7 @@ function set_sticky_bits {
}
function lockdown_permissions {
# All commands owned by root
if [ -d /bin ]; then
chown root:root /bin/*
fi
@ -448,6 +449,7 @@ function lockdown_permissions {
chmod -R +r /usr/share/${PROJECT_NAME}
fi
# All libraries owned by root
if [ -d /lib ]; then
chown -R root:root /lib/*
fi
@ -461,10 +463,12 @@ function lockdown_permissions {
chown -R root:root /usr/lib64/*
fi
# sudo permissions
chmod 4755 /usr/bin/sudo
chmod 4755 /usr/lib/sudo/sudoers.so
chown root:root /etc/sudoers
# permissions on email commands
if [ -f /usr/bin/procmail ]; then
chmod 6755 /usr/bin/procmail
fi
@ -476,6 +480,26 @@ function lockdown_permissions {
fi
set_sticky_bits
# Create some directories to correspond with users in passwords file
if [ ! -d /var/spool/lpd ]; then
mkdir /var/spool/lpd
fi
if [ ! -d /var/spool/news ]; then
mkdir /var/spool/news
fi
if [ ! -d /var/spool/uucp ]; then
mkdir /var/spool/uucp
fi
if [ ! -d /var/list ]; then
mkdir /var/list
fi
if [ ! -d /var/lib/gnats ]; then
mkdir /var/lib/gnats
fi
if [ ! -d /var/lib/saned ]; then
mkdir /var/lib/saned
fi
}
function disable_core_dumps {

View File

@ -1,5 +1,5 @@
#!/bin/bash
if [ $(pwck -rq | wc -l ) -ne 0 ];then
if [ $(pwck -r | sed '/nonexist/d' | sed '/\/home\//d' | sed '/\/run\//d' | sed '/no changes/d' | wc -l ) -ne 0 ];then
exit 1
fi