summaryrefslogtreecommitdiff
path: root/kernels/linux-libre-grsec/linux-libre-grsec.install
blob: dfdf39530808410a50f5a374f4a62a6c72469a90 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# arg 1:  the new package version
# arg 2:  the old package version

KERNEL_NAME=-grsec
KERNEL_VERSION=

_fix_permissions() {
  /usr/bin/pax-flags-libre -y

  echo
  echo You can repeat this process after updating or installing affected
  echo binaries by running "pax-flags-libre".
}

_add_proc_group() {
  if ! getent group proc-trusted >/dev/null; then
    groupadd -g 9998 -r proc-trusted
  fi
}

_add_tpe_group() {
  if getent group grsec-trusted >/dev/null; then
    groupmod -n tpe-trusted grsec-trusted
  fi

  if ! getent group tpe-trusted >/dev/null; then
    groupadd -g 9999 -r tpe-trusted
  fi
}

_add_socket_deny_groups() {
  if ! getent group socket-deny-server >/dev/null; then
    groupadd -g 9997 -r socket-deny-server
  fi

  if ! getent group socket-deny-client >/dev/null; then
    groupadd -g 9996 -r socket-deny-client
  fi

  if ! getent group socket-deny-all >/dev/null; then
    groupadd -g 9995 -r socket-deny-all
  fi
}

_add_groups() {
  _add_proc_group
  _add_tpe_group
  _add_socket_deny_groups
}

_remove_groups() {
  for group in grsec-trusted proc-trusted tpe-trusted socket-deny-server socket-deny-client socket-deny-all; do
    if getent group $group >/dev/null; then
	  groupdel $group
    fi
  done
}

_help() {
cat <<EOF

Configuration of grsecurity features via sysctl is possible in
"/etc/sysctl.d/05-grsecurity.conf".

For group tpe-trusted, Trusted Path Execution is disabled. For group
proc-trusted, the access to /proc is not restricted. Think carefully before
adding a normal user to these groups.

To prevent certain socket access to users, there are three groups:
socket-deny-server, socket-deny-client and socket-deny-all.

EOF
}

post_install () {
  # updating module dependencies
  echo ">>> Updating module dependencies. Please wait ..."
  depmod ${KERNEL_VERSION}
  if command -v mkinitcpio 2>&1 > /dev/null; then
    echo ">>> Generating initial ramdisk, using mkinitcpio.  Please wait..."
    mkinitcpio -p linux-libre${KERNEL_NAME}
  fi

  _add_groups
  _fix_permissions

  _help
}

post_upgrade() {
  if findmnt --fstab -uno SOURCE /boot &>/dev/null && ! mountpoint -q /boot; then
    echo "WARNING: /boot appears to be a separate partition but is not mounted."
  fi

  # updating module dependencies
  echo ">>> Updating module dependencies. Please wait ..."
  depmod ${KERNEL_VERSION}
  if command -v mkinitcpio 2>&1 > /dev/null; then
    echo ">>> Generating initial ramdisk, using mkinitcpio.  Please wait..."
    mkinitcpio -p linux-libre${KERNEL_NAME}
  fi

  _add_groups
  _fix_permissions

  _help
}

post_remove() {
  # also remove the compat symlinks
  rm -f boot/initramfs-linux-libre${KERNEL_NAME}.img
  rm -f boot/initramfs-linux-libre${KERNEL_NAME}-fallback.img

  _remove_groups
}