meatbag/baseimage-alpine
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Add tamper check until legacy custom files location removed

Browse source
This commit is contained in:
TheSpad 2022-06-09 11:51:02 +01:00
parent 6ac3a53809
commit 32e37c440b
No known key found for this signature in database
GPG key ID: 08F06191F4587860
7 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

0
root/etc/s6-overlay/s6-rc.d/init-adduser/dependencies.d/init-tamper-check Normal file
View file

0
root/etc/s6-overlay/s6-rc.d/init-base/dependencies.d/init-tamper-check Normal file
View file

0
root/etc/s6-overlay/s6-rc.d/init-tamper-check/dependencies.d/init-script-check Normal file
View file

18
root/etc/s6-overlay/s6-rc.d/init-tamper-check/run Executable file
View file

@ -0,0 +1,18 @@
#!/usr/bin/with-contenv bash
if ([ -d "/config/custom-cont-init.d" ] && [ -n "$(find /config/custom-cont-init.d ! -user root)" ]) || ([ -d "/config/custom-services.d" ] && [ -n "$(find /config/custom-services.d ! -user root)" ]); then
echo "**** Potential tampering with custom scripts/services detected ****"
randstr=$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c${1:-8};echo;)
for folder in "/config/custom-cont-init.d" "/config/custom-services.d"; do
if [ -d "${folder}" ]; then
mv "${folder}" "${folder}.${randstr}"
echo "**** Folder ${folder} is moved to ${folder}.${randstr} ****"
fi
done
echo "**** The folders '/config/custom-cont-init.d' and '/config/custom-services.d'; and their contents need to all be owned by root to prevent root escalation inside the container!!! ****"
mkdir -p /config/custom-cont-init.d /config/custom-services.d
chown 0:0 /config/custom-cont-init.d /config/custom-services.d
elif ([ -d "/config/custom-cont-init.d" ] && [ -n "$(find /config/custom-cont-init.d -perm -o+w)" ]) || ([ -d "/config/custom-services.d" ] && [ -n "$(find /config/custom-services.d -perm -o+w)" ]); then
echo "**** The folders '/config/custom-cont-init.d' or '/config/custom-services.d'; or some of their contents have write permissions for others, which is a security risk. ****"
echo "**** Please review the permissions of these two folders and their contents to make sure they are owned by root, and can only be modified by root. ****"
fi

1
root/etc/s6-overlay/s6-rc.d/init-tamper-check/type Normal file
View file

@ -0,0 +1 @@
oneshot

1
root/etc/s6-overlay/s6-rc.d/init-tamper-check/up Normal file
View file

@ -0,0 +1 @@
/etc/s6-overlay/s6-rc.d/init-tamper-check/run

0
root/etc/s6-overlay/s6-rc.d/user/contents.d/init-tamper-check Normal file
View file