Changeset 119


Ignore:
Timestamp:
Sep 5, 2007, 1:04:57 AM (12 years ago)
Author:
rainer
Message:

Fix for ticket #75 (option to run suid check on nosuid file systems).

Location:
trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed
  • trunk/include/sh_suidchk.h

    r68 r119  
    1919int sh_suidchk_set_fps        (const char * c);
    2020int sh_suidchk_set_yield      (const char * c);
     21int sh_suidchk_set_nosuid     (const char * c);
    2122int sh_suidchk_set_quarantine (const char * c);
    2223int sh_suidchk_set_qmethod    (const char * c);
  • trunk/man/samhainrc.5

    r77 r119  
    303303.BI SuidCheckFps= fps
    304304Limit files per seconds for SUID check.
     305.br
     306.BI SuidCheckNosuid= 0|1
     307Check filesystems mounted as nosuid. Defaults to not.
     308.br
     309.BI SuidCheckQuarantineFiles= 0|1
     310Whether to quarantine files. Defaults to not.
     311.br
     312.BI SuidCheckQuarantineMethod= 0|1|2
     313Quarantine method. Delete = 1, remove suid/sgid flags = 1, move to quarantine directory = 2. Defaults to 1 (remove suid/sgid flags).
     314.br
     315.BI
    305316.TP
    306317.I "[Mounts]"
  • trunk/src/sh_suidchk.c

    r115 r119  
    112112  },
    113113  {
     114    N_("suidchecknosuid"),
     115    sh_suidchk_set_nosuid
     116  },
     117  {
    114118    N_("suidcheckquarantinefiles"),
    115119    sh_suidchk_set_quarantine
     
    134138static time_t  ShSuidchkInterval = 7200;
    135139static long    ShSuidchkFps      = 0;
     140static int     ShSuidchkNosuid   = S_FALSE;
    136141static int     ShSuidchkYield    = S_FALSE;
    137142static int     ShSuidchkQEnable  = S_FALSE;
     
    954959                  0 != strncmp (_("mmfs"),    fs, 4) &&
    955960                  0 != strncmp (_("msdos"),   fs, 5) &&
    956                   0 != strncmp (_("nfs"),     fs, 3) &&
    957                   0 != strncmp (_("nosuid"),  fs, 6) &&
     961                  0 != strncmp (_("nfs"),     fs, 3) &&
    958962                  0 != strncmp (_("proc"),    fs, 4) &&
    959963                  0 != strncmp (_("vfat"),    fs, 4)
     
    961965                  )
    962966                {
    963                   /* fprintf(stderr, "%s: %s\n", fs, tmpcat); */
    964                   (void) sh_suidchk_check_internal(tmpcat);
     967                  if ((ShSuidchkNosuid == S_TRUE) ||
     968                      (0 != strncmp (_("nosuid"),  fs, 6)))
     969                    /* fprintf(stderr, "%s: %s\n", fs, tmpcat); */
     970                    (void) sh_suidchk_check_internal(tmpcat);
    965971                }
    966972            }
     
    13741380}
    13751381
     1382int sh_suidchk_set_nosuid (const char * c)
     1383{
     1384  int i;
     1385  SL_ENTER(_("sh_suidchk_set_nosuid"));
     1386  i = sh_util_flagval(c, &ShSuidchkNosuid);
     1387  SL_RETURN(i, _("sh_suidchk_set_nosuid"));
     1388}
     1389
    13761390int sh_suidchk_set_quarantine (const char * c)
    13771391{
     
    19071921           */
    19081922#ifdef HAVE_HASMNTOPT
    1909           if (NULL == hasmntopt(mnt, "nosuid"))
     1923          if (NULL == hasmntopt(mnt, "nosuid") || (ShSuidchkNosuid == S_TRUE))
    19101924            type = mnt->mnt_type;
    19111925          else
     
    19851999       /* patch by Konstantin Khrooschev <nathoo@co.ru>
    19862000        */
    1987        if( fss.f_flag & ST_NOSUID )
     2001       if( (fss.f_flag & ST_NOSUID)  && (ShSuidchkNosuid == S_FALSE))
    19882002         type = _("nosuid");
    19892003    }
     
    20352049#ifdef MNT_VISFLAGMASK
    20362050      flags = fss.f_flags & MNT_VISFLAGMASK;
    2037       if (flags & MNT_NOSUID)
     2051      if ((flags & MNT_NOSUID) && (ShSuidchkNosuid == S_FALSE))
    20382052#else
    2039       if (fss.f_flags & MNT_NOSUID)
     2053      if ((fss.f_flags & MNT_NOSUID) && (ShSuidchkNosuid == S_FALSE))
    20402054#endif
    20412055         type = _("nosuid");
Note: See TracChangeset for help on using the changeset viewer.