security-misc.postinst

#!/bin/bash

## Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then
   source /usr/libexec/helper-scripts/pre.bsh
fi

## Required since this package uses debconf - this is mandatory even though
## the postinst itself does not use debconf commands.
source /usr/share/debconf/confmodule

set -e

true "
#####################################################################
## INFO: BEGIN: $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
#####################################################################
"

permission_hardening_legacy_config_folder() {
    if ! test -d /etc/permission-hardening.d ; then
        return 0
    fi
    rmdir --verbose --ignore-fail-on-non-empty /etc/permission-hardening.d || true
}

permission_hardening() {
    echo "Running SUID Disabler and Permission Hardener... See also:"
    echo "https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener"
    echo "$0: INFO: running: permission-hardener enable"
    if ! permission-hardener enable ; then
        echo "$0: ERROR: Permission hardening failed." >&2
        return 0
    fi
    echo "$0: INFO: Permission hardening success."
}

migrate_permission_hardener_state() {
   local existing_mode_dir new_mode_dir dpkg_statoverride_list
   ## If folder /var/lib/permission-hardener (version 1) does not exist, this migration is unneeded.
   if [ ! -d '/var/lib/permission-hardener' ]; then
      return 0
   fi

   if [ -f "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2" ]; then
     return 0
   fi
   mkdir --parents '/var/lib/security-misc/do_once'

   existing_mode_dir='/var/lib/permission-hardener-v2/existing_mode'
   new_mode_dir='/var/lib/permission-hardener-v2/new_mode'

   mkdir --parents "${existing_mode_dir}";
   mkdir --parents "${new_mode_dir}";

   cp --verbose '/usr/share/security-misc/permission-hardener-existing-mode-legacy-hardcoded' "${existing_mode_dir}/statoverride"
   cp --verbose '/usr/share/security-misc/permission-hardener-new-mode-legacy-hardcoded' "${new_mode_dir}/statoverride"

   dpkg_statoverride_list="$(dpkg-statoverride --admindir "${new_mode_dir}" --list)"

   if [ "$(stat --format '%G' /usr/bin/sudo)" = 'sysmaint' ]; then
      if ! [[ "${dpkg_statoverride_list}" =~ '/usr/bin/sudo' ]]; then
         dpkg-statoverride --admindir "${new_mode_dir}" --add 'root' 'sysmaint' '4750' '/usr/bin/sudo'
      fi
   fi
   if [ "$(stat --format '%G' /usr/bin/pkexec)" = 'sysmaint' ]; then
      if ! [[ "${dpkg_statoverride_list}" =~ '/usr/bin/pkexec' ]]; then
         dpkg-statoverride --admindir "${new_mode_dir}" --add 'root' 'sysmaint' '4750' '/usr/bin/pkexec'
      fi
   fi

   touch "/var/lib/security-misc/do_once/${FUNCNAME[0]}_version_2"
}

case "$1" in
    configure)
        if [ -d /etc/skel/.gnupg ]; then
            ## Lintian warns against use of chmod --recursive.
            chmod 700 /etc/skel/.gnupg
        fi

        ## /usr/share/glib-2.0/schemas/30_security-misc.gschema.override
        glib-compile-schemas /usr/share/glib-2.0/schemas || true

        ## state dir for faillock
        mkdir -p /var/lib/security-misc/faillock

        ## migrate permission_hardener state to v2 if applicable
        migrate_permission_hardener_state
    ;;

    abort-upgrade|abort-remove|abort-deconfigure)
    ;;

    triggered)
      echo "INFO: triggered $DPKG_MAINTSCRIPT_PACKAGE: '$DPKG_MAINTSCRIPT_PACKAGE' $DPKG_MAINTSCRIPT_PACKAGE DPKG_MAINTSCRIPT_NAME: '$DPKG_MAINTSCRIPT_NAME' $\*: '$*' 2: '$2'"
      /usr/share/security-misc/lkrg/lkrg-virtualbox || true
      /usr/libexec/security-misc/mmap-rnd-bits || true
      permission_hardening
      exit 0
    ;;

    *)
        echo "$DPKG_MAINTSCRIPT_NAME called with unknown argument \`$1'" >&2
        exit 1
    ;;
esac

pam-auth-update --package

/usr/libexec/security-misc/permission-lockdown

permission_hardening

## https://phabricator.whonix.org/T377
## Debian has no update-grub trigger yet:
## https://bugs.debian.org/481542
if command -v update-grub >/dev/null 2>&1; then
   update-grub || \
      echo "$DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME ERROR: Running \
'update-grub' failed with exit code $?. $DPKG_MAINTSCRIPT_PACKAGE is most \
likely only the trigger, not the cause. Unless you know this is not an issue, \
you should fix running 'update-grub', otherwise your system might no longer \
boot." >&2
fi

/usr/libexec/security-misc/mmap-rnd-bits || true

true "INFO: debhelper beginning here."

#DEBHELPER#

true "INFO: Done with debhelper."

permission_hardening_legacy_config_folder

true "
#####################################################################
## INFO: END  : $DPKG_MAINTSCRIPT_PACKAGE $DPKG_MAINTSCRIPT_NAME $*
#####################################################################
"

## Explicitly "exit 0", so eventually trapped errors can be ignored.
exit 0