Public feed
#887751
#!/bin/bash## Copyright (C) 2005-2006 nickelplated.net## This program is free software; you can redistribute it and/or modify# it under the terms of the GNU General Public License as published by# the Free Software Foundation; either version 2 of the License, or# (at your option) any later version.## This program is distributed in the hope that it will be useful,# but WITHOUT ANY WARRANTY; without even the implied warranty of# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the# GNU General Public License for more details.## You should have received a copy of the GNU General Public License# along with this program; if not, write to the Free Software# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA## GNU/GPL license can be found here: http://www.gnu.org/licenses/gpl.txt## permcheck.sh# Script to find and remove suid/sgid flags from all but necessary binaries like # passwd and su and to find questionably unsafe file permissions and attributes # on your filesystem and fix them. There are 4 modes of operation, --checksuid, # --removesuid, --checkperm, and --removeperm. Use --checksuid to find any files # with suid or sgid flags. Next use --removesuid and enter any files to exclude. # Use --checkperm to find any unsafe file and directory permissions. Next use # --removeperm and enter any files to exclude. Viola! All of the questionably # unsafe file and directory permissions have been removed.## version: 0.2 (051606002)# - added support for solaris# - updated flags# - updated find directives# - still not completed (existing functions tested and working)# version: 0.1# - initial releaseusage() { echo "usage: $1 <option>" echo " -h or --help: prints this usage message." echo " -s or --checksuid: checks for suid/gid files permissions." echo " -S or --removesuid: remove suid/gid file permissions." echo " -p or --checkperm: check for rwx global file/directory permissions." echo " -P or --removeperm: remove rwx global file/directory permissions."}checksuid() { echo "checking for suid files.." $SUIDFINDCMD echo "checking for sgid files.." $SGIDFINDCMD}removesuid() { echo "enter a space seperated list of filenames to exclude from suid/gid permission removal. (su and passwd are automatic exceptions)" echo -n "exceptions: " read SUIDEXCEPTIONS if [ -z $SUIDEXCEPTIONS ]; then SUIDEXCEPTIONS="someridiculousvariablesotheforloopwillwork" fi echo "finding suid permissions.." SUIDPERMS=`$SUIDFINDCMD` for suidfile in $SUIDPERMS; do for suidexcept in $SUIDEXCEPTIONS; do case $suidfile in */$suidexcept) continue ;; */su) continue ;; */passwd) continue ;; *) if [ "`uname`" == "FreeBSD" ]; then # this is needed because freebsd links passwd and yppasswd if [ "$suidfile" == "/usr/bin/yppasswd" ]; then continue fi if [ -n "`/bin/ls -lo $suidfile|grep chg`" ]; then echo "chflags noschg $suidfile" chflags noschg $suidfile fi fi echo "chmod -s $suidfile" chmod -s $suidfile ;; esac done done echo "suid removal completed." echo "finding sgid permissions.." SGIDPERMS=`$SGIDFINDCMD` for sgidfile in $SGIDPERMS; do for sgidexcept in $SUIDEXCEPTIONS; do case $sgidfile in */$sgidexcept) continue ;; */su) continue ;; */passwd) continue ;; *) if [ "`uname`" == "FreeBSD" ]; then # this is needed because freebsd links passwd and yppasswd if [ "$sgidfile" == "/usr/bin/yppasswd" ]; then continue fi if [ -n "`/bin/ls -lo $sgidfile|grep chg`" ]; then echo "chflags noschg $sgidfile" chflags noschg $sgidfile fi fi echo "chmod -s $sgidfile" chmod -s $sgidfile ;; esac done done echo "sgid removal completed."}checkperm() { echo "checking for global writable suid files.." $GFSUFINDCMD echo "checking for global writable suid directories.." $GDSUFINDCMD echo "checking for global writable sgid files.." $GFSGFINDCMD echo "checking for global writable sgid directories.." $GDSGFINDCMD echo "checking for global writable files.." $GFFINDCMD echo "checking for global writable directories.." $GDFINDCMD}removeperm() { echo "removing unsafe file/directory permissions"}# script startif ! [ $# == "1" ]; then usage $0 exit 99fiif ! [ $EUID == "0" ]; then echo "ERROR: script must run as root!" exit 110fiSUIDFINDCMD="find / -perm -4000 -type f -print"SGIDFINDCMD="find / -perm -2000 -type f -print"GFFINDCMD="find / -perm -0002 -type f -print"GDFINDCMD="find / -perm -0002 -type d -print"GFSUFINDCMD="find / -perm -4002 -type f -print"GDSUFINDCMD="find / -perm -4002 -type d -print"GFSGFINDCMD="find / -perm -2002 -type f -print"GDSGFINDCMD="find / -perm -2002 -type d -print"if [ -n $1 ]; then case $1 in -h|--help) usage $0 ;; -s|--checksuid) checksuid ;; -S|--removesuid) removesuid ;; -p|--checkperm) checkperm ;; -P|--removeperm) removeperm ;; *) usage $0 ;; esacfi