summaryrefslogtreecommitdiff
path: root/kernels/linux-libre-grsec/linux-libre-grsec.install
blob: a833e9134c9781045833ff4257f43200a1168231 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
# arg 1:  the new package version
# arg 2:  the old package version

KERNEL_NAME=-grsec
KERNEL_VERSION=3.7.1-4-LIBRE-GRSEC

_fix_permissions() {
  /usr/bin/paxutils

  echo
  echo You can repeat this process after updating or installing affected
  echo binaries by running "paxutils".
}

_add_proc_group() {
  if ! getent group proc-trusted >/dev/null; then
    groupadd -g 9998 -r proc-trusted
    useradd -g 9998 -r proc-trusted
  fi
}

_add_tpe_group() {
  if getent group grsec-trusted >/dev/null; then
    groupmod -n tpe-trusted grsec-trusted
  fi

  if ! getent group tpe-trusted >/dev/null; then
    groupadd -g 9999 -r tpe-trusted
    useradd -g 9999 -r tpe-trusted
  fi
}

_help() {
  echo
  echo For group tpe-trusted, Trusted Path Execution is disabled. For group
  echo proc-trusted, the access to /proc is not restricted. Think carefully
  echo before adding a normal user to this group.
  echo
  echo This is controllable with the sysctl options \"kernel.grsecurity.tpe*\".
  echo
  echo There is an extensive wikibook on grsecurity:
  echo http://en.wikibooks.org/wiki/Grsecurity
}

# set a sane PATH to ensure that critical utils like depmod will be found
export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'

post_install () {
  # updating module dependencies
  echo ">>> Updating module dependencies. Please wait ..."
  depmod ${KERNEL_VERSION}
  if command -v mkinitcpio 2>&1 > /dev/null; then
    echo ">>> Generating initial ramdisk, using mkinitcpio.  Please wait..."
    mkinitcpio -p linux-libre${KERNEL_NAME}
  fi

  # compat symlinks for the official kernels only
  if [ -z "${KERNEL_NAME}" -o "${KERNEL_NAME}" = "-grsec" ]; then
    loaders="$(find /boot -name syslinux.cfg -or -name extlinux.conf -or -name grub.cfg -or -name menu.lst)"
    [ -f /etc/lilo.conf ] && loaders="$loaders /etc/lilo.conf"
    if [ -n "${loaders}" ] && grep -q -e vmlinuz26 -e kernel26.img -e kernel26-fallback.img $loaders; then
      # add compat symlinks for the initramfs images
      ln -sf initramfs-linux-libre${KERNEL_NAME}.img boot/kernel26${KERNEL_NAME}.img
      ln -sf initramfs-linux-libre${KERNEL_NAME}-fallback.img \
        boot/kernel26${KERNEL_NAME}-fallback.img
      ln -sf vmlinuz-linux-libre${KERNEL_NAME} /boot/vmlinuz26${KERNEL_NAME}
    fi
  fi

  _add_proc_group
  _add_tpe_group
  _fix_permissions
  
  _help
}

post_upgrade() {
  pacman -Q grub &>/dev/null
  hasgrub=$?
  pacman -Q grub-common &>/dev/null
  hasgrub2=$?
  pacman -Q lilo &>/dev/null
  haslilo=$?
  # reminder notices
  if [ $haslilo -eq 0 ]; then
    echo ">>>"
    if [ $hasgrub -eq 0 -o $hasgrub2 -eq 0 ]; then
      echo ">>> If you use the LILO bootloader, you should run 'lilo' before rebooting."
    else
      echo ">>> You appear to be using the LILO bootloader. You should run"
      echo ">>> 'lilo' before rebooting."
    fi
    echo ">>>"
  fi

  if findmnt --fstab -uno SOURCE /boot &>/dev/null && ! mountpoint -q /boot; then
    echo "WARNING: /boot appears to be a separate partition but is not mounted."
  fi

  # updating module dependencies
  echo ">>> Updating module dependencies. Please wait ..."
  depmod ${KERNEL_VERSION}
  if command -v mkinitcpio 2>&1 > /dev/null; then
    echo ">>> Generating initial ramdisk, using mkinitcpio.  Please wait..."
    mkinitcpio -p linux-libre${KERNEL_NAME}
  fi

  _add_proc_group
  _add_tpe_group
  _fix_permissions

  _help
}

post_remove() {
  # also remove the compat symlinks
  rm -f boot/{initramfs-linux-libre,kernel26}${KERNEL_NAME}.img
  rm -f boot/{initramfs-linux-libre,kernel26}${KERNEL_NAME}-fallback.img

  for group in grsec-trusted proc-trusted tpe-trusted; do
    if getent group $group >/dev/null; then
	  groupdel $group
    fi
  done
}