From 95ad89d24e8e75f2f52defbb80d0d4ee0f27d31e Mon Sep 17 00:00:00 2001 From: glitsj16 Date: Tue, 15 Dec 2020 20:06:10 +0000 Subject: Refactor archivers ii (#3827) * harden 7z.profile * harden atool.profile * harden bsdtar.profile * harden cpio.profile * harden gzip.profile * harden tar.profile * harden unrar.profile * harden unzip.profile * harden xzdec.profile * harden zstd.profile --- etc/profile-a-l/7z.profile | 6 +++--- etc/profile-a-l/atool.profile | 3 --- etc/profile-a-l/bsdtar.profile | 2 -- etc/profile-a-l/cpio.profile | 3 --- etc/profile-a-l/gzip.profile | 3 ++- 5 files changed, 5 insertions(+), 12 deletions(-) (limited to 'etc/profile-a-l') diff --git a/etc/profile-a-l/7z.profile b/etc/profile-a-l/7z.profile index c7bed93ce..4f9e72a79 100644 --- a/etc/profile-a-l/7z.profile +++ b/etc/profile-a-l/7z.profile @@ -7,8 +7,8 @@ include 7z.local # Persistent global definitions include globals.local -ignore include disable-shell.inc -ignore nogroups +noblacklist ${PATH}/bash +noblacklist ${PATH}/sh include archiver-common.inc -#private-bin 7z,7z*,p7zip +private-bin 7z,7z*,bash,p7zip,sh diff --git a/etc/profile-a-l/atool.profile b/etc/profile-a-l/atool.profile index d8b6bbaaf..34af47df2 100644 --- a/etc/profile-a-l/atool.profile +++ b/etc/profile-a-l/atool.profile @@ -9,13 +9,10 @@ include globals.local # Allow perl (blacklisted by disable-interpreters.inc) include allow-perl.inc -ignore include disable-devel.inc -ignore include disable-shell.inc include archiver-common.inc noroot -# private-bin atool,perl # without login.defs atool complains and uses UID/GID 1000 by default private-etc alternatives,group,login.defs,passwd private-tmp diff --git a/etc/profile-a-l/bsdtar.profile b/etc/profile-a-l/bsdtar.profile index 75e13e7e8..f2116f4ab 100644 --- a/etc/profile-a-l/bsdtar.profile +++ b/etc/profile-a-l/bsdtar.profile @@ -6,8 +6,6 @@ include bsdtar.local # Persistent global definitions include globals.local -ignore include disable-devel.inc -ignore include disable-shell.inc include archiver-common.inc # support compressed archives diff --git a/etc/profile-a-l/cpio.profile b/etc/profile-a-l/cpio.profile index 5e01952b4..785308ffd 100644 --- a/etc/profile-a-l/cpio.profile +++ b/etc/profile-a-l/cpio.profile @@ -10,7 +10,4 @@ include globals.local noblacklist /sbin noblacklist /usr/sbin -ignore include disable-devel.inc -ignore include disable-interpreters.inc -ignore include disable-shell.inc include archiver-common.inc diff --git a/etc/profile-a-l/gzip.profile b/etc/profile-a-l/gzip.profile index 96c1743e3..78ecf5116 100644 --- a/etc/profile-a-l/gzip.profile +++ b/etc/profile-a-l/gzip.profile @@ -10,5 +10,6 @@ include globals.local # Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only. noblacklist /var/lib/pacman -ignore include disable-shell.inc include archiver-common.inc + +private-bin gunzip,gzexe,gzip,uncompress,zcat,zcmp,zdiff,zegrep,zfgrep,zforce,zgrep,zless,zmore,znew -- cgit v1.2.3-70-g09d2