From 200374494f0b3b91a63ad8a226d6228d3e5841af Mon Sep 17 00:00:00 2001 From: TheSpad Date: Tue, 13 Sep 2022 11:25:16 +0100 Subject: [PATCH] Remove custom svc from user bundle --- root/docker-mods | 18 ++++++++++-------- root/etc/cont-init.d/99-custom-files | 2 +- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/root/docker-mods b/root/docker-mods index cfa3484..1902610 100755 --- a/root/docker-mods +++ b/root/docker-mods @@ -11,18 +11,18 @@ set_legacy_executable_bits() { tamper_check() { #Tamper check custom service locations - if [[ -d "${SERVICES_DIR}" ]] && [[ -n "$(find ${SERVICES_DIR}/* ! -user root)" ]]; then + if [[ -d "${SERVICES_DIR}" ]] && [[ -n "$(find ${SERVICES_DIR}/* ! -user root 2>/dev/null)" ]]; then echo "[custom-init] **** Some of the contents of the folder '${SERVICES_DIR}' are not owned by root, which is a security risk. ****" echo "[custom-init] **** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" - elif [[ -d "${SERVICES_DIR}" ]] && [[ -n "$(find ${SERVICES_DIR}/* -perm -o+w)" ]]; then + elif [[ -d "${SERVICES_DIR}" ]] && [[ -n "$(find ${SERVICES_DIR}/* -perm -o+w 2>/dev/null)" ]]; then echo "[custom-init] **** Some of the contents of the folder '${SERVICES_DIR}' have write permissions for others, which is a security risk. ****" echo "[custom-init] **** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" fi #Tamper check custom script locations - if [[ -d "${SCRIPTS_DIR}" ]] && [[ -n "$(find ${SCRIPTS_DIR}/* ! -user root)" ]]; then + if [[ -d "${SCRIPTS_DIR}" ]] && [[ -n "$(find ${SCRIPTS_DIR}/* ! -user root 2>/dev/null)" ]]; then echo "[custom-init] **** Some of the contents of the folder '${SCRIPTS_DIR}' are not owned by root, which is a security risk. ****" echo "[custom-init] **** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" - elif [[ -d "${SCRIPTS_DIR}" ]] && [[ -n "$(find ${SCRIPTS_DIR}/* -perm -o+w)" ]]; then + elif [[ -d "${SCRIPTS_DIR}" ]] && [[ -n "$(find ${SCRIPTS_DIR}/* -perm -o+w 2>/dev/null)" ]]; then echo "[custom-init] **** Some of the contents of the folder '${SCRIPTS_DIR}' have write permissions for others, which is a security risk. ****" echo "[custom-init] **** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" fi @@ -30,7 +30,7 @@ tamper_check() { tamper_check_legacy() { # Tamper check custom script locations - if [[ -d "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(find ${SCRIPTS_DIR_OLD} ! -user root)" ]]; then + if [[ -d "${SCRIPTS_DIR_OLD}" ]] && [[ -n "$(find ${SCRIPTS_DIR_OLD} ! -user root 2>/dev/null)" ]]; then echo "**** Potential tampering with custom scripts detected ****" randstr=$( tr /dev/null)" ]]; then echo "[custom-init] **** The folder '${SCRIPTS_DIR_OLD}' or some of its contents have write permissions for others, which is a security risk. ****" echo "[custom-init] **** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" fi # Tamper check custom service locations - if [[ -d "${SERVICES_DIR_OLD}" ]] && [[ -n "$(find ${SERVICES_DIR_OLD} ! -user root)" ]]; then + if [[ -d "${SERVICES_DIR_OLD}" ]] && [[ -n "$(find ${SERVICES_DIR_OLD} ! -user root 2>/dev/null)" ]]; then echo "[custom-init] **** Potential tampering with custom scripts detected ****" randstr=$( tr /dev/null)" ]]; then echo "[custom-init] **** The folder '${SERVICES_DIR_OLD}' or some of its contents have write permissions for others, which is a security risk. ****" echo "[custom-init] **** Please review the permissions of this folder and its contents to make sure they are owned by root, and can only be modified by root. ****" fi @@ -66,6 +66,7 @@ process_custom_services() { if [[ -n "$(/bin/ls -A /etc/s6-overlay/s6-rc.d/custom-svc-* 2>/dev/null)" ]]; then echo "[custom-init] removing existing custom services..." rm -rf /etc/s6-overlay/s6-rc.d/custom-svc-* + rm /etc/s6-overlay/s6-rc.d/user/contents.d/custom-svc-* fi # Make sure custom service directory exists and has files in it @@ -104,6 +105,7 @@ process_custom_services_legacy() { if [[ -n "$(/bin/ls -A /etc/s6-overlay/s6-rc.d/custom-svc-* 2>/dev/null)" ]]; then echo "[custom-init] removing existing custom services..." rm -rf /etc/s6-overlay/s6-rc.d/custom-svc-* + rm /etc/s6-overlay/s6-rc.d/user/contents.d/custom-svc-* fi # Make sure custom service directory exists and has files in it diff --git a/root/etc/cont-init.d/99-custom-files b/root/etc/cont-init.d/99-custom-files index 1ea5595..6ebe2d2 100755 --- a/root/etc/cont-init.d/99-custom-files +++ b/root/etc/cont-init.d/99-custom-files @@ -57,7 +57,7 @@ fi if [[ -n "$(/bin/ls -A "${SCRIPTS_DIR_OLD}" 2>/dev/null)" ]] || [[ -n "$(/bin/ls -A "${SERVICES_DIR_OLD}" 2>/dev/null)" ]]; then - cat << EOF | tee {${SCRIPTS_DIR_OLD}/README.txt,${SERVICES_DIR_OLD}/README.txt} 2>/dev/null + cat << EOF | tee ${SCRIPTS_DIR_OLD}/README.txt 2>/dev/null ******************************************************** ******************************************************** * *