PTah
c50bd6e9d8
Hardening state files under /var/log was applying chmod 700 to the parent directory, which broke syslog/logrotate and other services after agent update.
51 lines
1.4 KiB
Bash
51 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Smoke-test: hardening must not chmod system dirs like /var/log.
|
|
set -euo pipefail
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
# shellcheck source=/dev/null
|
|
source "$ROOT/ssh-monitor-perms.sh"
|
|
|
|
fail=0
|
|
assert_true() {
|
|
if "$@"; then
|
|
return 0
|
|
fi
|
|
printf 'FAIL: expected true: %s\n' "$*" >&2
|
|
fail=1
|
|
}
|
|
assert_false() {
|
|
if "$@"; then
|
|
printf 'FAIL: expected false: %s\n' "$*" >&2
|
|
fail=1
|
|
return 0
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
assert_true ssh_monitor_is_system_dir /var/log
|
|
assert_true ssh_monitor_is_system_dir /var/log/
|
|
assert_true ssh_monitor_is_system_dir /etc
|
|
assert_true ssh_monitor_is_system_dir /var
|
|
assert_true ssh_monitor_is_system_dir /
|
|
assert_false ssh_monitor_is_system_dir /var/lib/ssh-monitor
|
|
assert_false ssh_monitor_is_system_dir /var/lib/ssh-monitor/sac-spool
|
|
|
|
tmpdir="$(mktemp -d)"
|
|
trap 'rm -rf "$tmpdir"' EXIT
|
|
# Private dir still gets 700 (на настоящем Linux; в Git Bash/Windows mode может не примениться)
|
|
ssh_monitor_secure_dir "$tmpdir/owned"
|
|
mode="$(stat -c '%a' "$tmpdir/owned" 2>/dev/null || stat -f '%OLp' "$tmpdir/owned" 2>/dev/null || echo "")"
|
|
if [ -n "$mode" ] && [ "$mode" != "700" ] && [ "$mode" != "0700" ]; then
|
|
if [[ "$(uname -s 2>/dev/null || true)" == Linux ]]; then
|
|
printf 'FAIL: owned dir mode=%s (want 700)\n' "$mode" >&2
|
|
fail=1
|
|
else
|
|
printf 'WARN: skip mode assert on non-Linux (mode=%s)\n' "$mode" >&2
|
|
fi
|
|
fi
|
|
|
|
if [ "$fail" -ne 0 ]; then
|
|
exit 1
|
|
fi
|
|
printf 'OK: system-dir hardening guards\n'
|