diff options
| -rw-r--r-- | perl-install/security/msec.pm | 115 | ||||
| -rwxr-xr-x | perl-install/standalone/draksec | 44 |
2 files changed, 80 insertions, 79 deletions
diff --git a/perl-install/security/msec.pm b/perl-install/security/msec.pm index d02e16610..7991b913f 100644 --- a/perl-install/security/msec.pm +++ b/perl-install/security/msec.pm @@ -12,9 +12,6 @@ my $check_file = "$::prefix/etc/security/msec/security.conf"; my $curr_sec_file = "$::prefix/var/lib/msec/security.conf"; my $options_file = "$::prefix/etc/security/msec/level.local"; -# *********************************************** -# PRIVATE FUNCTIONS -# *********************************************** my $num_level; @@ -50,7 +47,6 @@ sub load_defaults { # get_XXX_default(function) - # return the default of the function|check passed in argument. -# If no default is set, return "default". sub get_check_default { my ($msec, $check) = @_; @@ -77,9 +73,9 @@ sub load_values { do { print "BACKTRACE:\n", backtrace(), "\n"; die 'wrong category' } unless $separator; map { my ($opt, $val) = split /$separator/; - $val =~ s/[()]//g; - chop $opt if $separator eq '\('; # $opt =~ s/ //g if $separator eq '\('; chop $val; + $val =~ s/[()]//g; + chop $opt if $separator eq '\('; # $opt =~ s/ //g if $separator eq '\('; $opt => $val; } cat_($item_file); } @@ -103,15 +99,19 @@ sub get_check_value { -# *********************************************** -# FUNCTIONS (level.local) RELATED -# *********************************************** +#------------------------------------------------------------- +# get list of functions + +# list_(functions|checks) - +# return a list of functions|checks handled by level.local|security.conf + +sub list_checks { + my ($msec) = @_; + map { if_(!member($_, qw(MAIL_WARN MAIL_USER)), $_) } keys %{$msec->{checks}{default}}; +} -# get_functions() - -# return a list of functions handled by level.local (see -# man mseclib for more info). -sub get_functions { - my (undef, $category) = @_; +sub list_functions { + my ($msec, $category) = @_; my @functions; ## TODO handle 3 last functions here so they can be removed from this list @@ -129,55 +129,58 @@ sub get_functions { enable_sulogin password_aging password_history password_length set_root_umask set_shell_history_size set_shell_timeout set_user_umask)]); - my $file = "$::prefix/usr/share/msec/mseclib.py"; - my $function; - - # read mseclib.py to get each function's name and if it's - # not in the ignore list, add it to the returned list. - foreach (cat_($file)) { - if (/^def/) { - (undef, $function) = split / /; - ($function, undef) = split(/\(/, $function); - if (!member($function, @ignore_list) && member($function, @{$options{$category}})) { - push(@functions, $function) - } - } - } - - @functions; + # get all function names; filter out those which are in the ignore + # list, return what lefts. + map { if_(!member($_, @ignore_list) && member($_, @{$options{$category}}), $_) } keys %{$msec->{functions}{default}}; } -# config_function(function, value) - -# Apply the configuration to 'prefix'/etc/security/msec/level.local -sub config_function { - my (undef, $function, $value) = @_; - substInFile { s/^$function.*\n// } $options_file; - append_to_file($options_file, "$function ($value)") if $value ne 'default'; -} +#------------------------------------------------------------- +# set back checks|functions values -# *********************************************** -# PERIODIC CHECKS (security.conf) RELATED -# *********************************************** +sub set_function { + my ($msec, $function, $value) = @_; + $msec->{functions}{value}{$function} = $value; +} -# get_default_checks() - -# return a list of periodic checks handled by security.conf -sub get_default_checks { - my ($msec) = @_; - keys %{$msec->{checks}{default}}; +sub set_check { + my ($msec, $check, $value) = @_; + $msec->{checks}{value}{$check} = $value; } +#------------------------------------------------------------- +# apply configuration + +# config_(check|function)(check|function, value) - +# Apply the configuration to 'prefix'/etc/security/msec/security.conf||/etc/security/msec/level.local -# config_check(check, value) -# Apply the configuration to "$::prefix"/etc/security/msec/security.conf -sub config_check { - my (undef, $check, $value) = @_; - if ($value eq 'default') { - substInFile { s/^$check.*\n// } $check_file; - } else { - setVarsInSh($check_file, { $check => $value }); - } +sub apply_functions { + my ($msec) = @_; + my @list = ($msec->list_functions('system'), $msec->list_functions('network')); + substInFile { + foreach my $function (@list) { s/^$function.*\n// } + if (eof) { + print "\n", join("\n", map { + my $value = $msec->get_function_value($_); + if_($value ne 'default', "$_ ($value)"); + } @list); + } + } $options_file; +} + +sub apply_checks { + my ($msec) = @_; + my @list = $msec->list_checks; + substInFile { + foreach my $check (@list) { s/^$check.*\n// } + if (eof) { + print "\n", join("\n", map { + my $value = $msec->get_check_value($_); + if_($value ne 'default', $_ . '=' . $value); + } @list), "\n"; + } + } $check_file; } sub new { @@ -185,8 +188,8 @@ sub new { my $thing = {}; $thing->{checks}{default} = { load_defaults('checks') }; $thing->{functions}{default} = { load_defaults('functions') }; - $thing->{functions}{value} = { load_values('functions') }; - $thing->{checks}{value} = { load_values('checks') }; + $thing->{functions}{value} = { load_values('functions') }; + $thing->{checks}{value} = { load_values('checks') }; bless $thing, $type; } diff --git a/perl-install/standalone/draksec b/perl-install/standalone/draksec index 234284513..57a2d8136 100755 --- a/perl-install/standalone/draksec +++ b/perl-install/standalone/draksec @@ -40,7 +40,7 @@ my $w; # factorize this with rpmdrake and harddrake2 sub wait_msg { - my $mainw = ugtk2->new('wait', ( modal => 1, transient => $w->{rwindow})); + my $mainw = ugtk2->new('wait', (modal => 1, if_(!$::isEmbedded, transient => $w->{rwindow}))); my $label = new Gtk2::Label($_[0]); $mainw->{window}->add($label); $mainw->{window}->show_all; @@ -178,7 +178,7 @@ foreach ([ 'network', N("Network Options") ], [ 'system', N("System Options") ]) $entry->set_text($msec->get_function_value($i)); set_help_tip($entry, $default, $i); [ new Gtk2::Label($i), $values{$i} ]; - } sort $msec->get_functions($domain))))), + } sort $msec->list_functions($domain))))), new Gtk2::Label($label)); $options_values{$domain} = \%values; } @@ -190,16 +190,14 @@ $notebook->append_page(gtkshow(create_scrolled_window(gtkpack_(new Gtk2::VBox(0, 0, new Gtk2::Label($help_msg), 1, create_packtable($common_opts, map { - unless (member(qw(MAIL_WARN MAIL_USER), $_)) { - my $i = $_; - $security_checks_value{$i} = new_editable_combo(); - my $entry = $security_checks_value{$i}->entry; - set_help_tip($entry, $msec->get_check_default($i), $i); - $security_checks_value{$i}->set_popdown_strings(qw(yes no default)); - $entry->set_text($msec->get_check_value($i)); - [ gtkshow(new Gtk2::Label(translate($i))), $security_checks_value{$i} ]; - } else { undef } - } sort $msec->get_default_checks)))), + my $i = $_; + $security_checks_value{$i} = new_editable_combo(); + my $entry = $security_checks_value{$i}->entry; + set_help_tip($entry, $msec->get_check_default($i), $i); + $security_checks_value{$i}->set_popdown_strings(qw(yes no default)); + $entry->set_text($msec->get_check_value($i)); + [ gtkshow(new Gtk2::Label(translate($i))), $security_checks_value{$i} ]; + } sort $msec->list_checks)))), new Gtk2::Label(N("Periodic Checks"))); @@ -215,34 +213,34 @@ my $bok = gtksignal_connect(new Gtk2::Button(N("Ok")), if ($seclevel_value ne security::level::get_string()) { $w = wait_msg(N("Please wait, setting security level...")); - log::explanations("Setting security level"); + log::explanations("Setting security level to $seclevel_value"); security::level::set($seclevel_value); remove_wait_msg($w); } $w = wait_msg(N("Please wait, setting security options...")); log::explanations("Setting security administrator option"); - $msec->config_check('MAIL_WARN', $secadmin_check_value == 1 ? 'yes' : 'no'); + $msec->set_check('MAIL_WARN', $secadmin_check_value == 1 ? 'yes' : 'no'); if ($secadmin_value ne $msec->get_check_value('MAIL_USER') && $secadmin_check_value) { log::explanations("Setting security administrator contact"); - $msec->config_check('MAIL_USER', $secadmin_value); + $msec->set_check('MAIL_USER', $secadmin_value); } log::explanations("Setting security periodic checks"); foreach my $key (keys %security_checks_value) { - if ($security_checks_value{$key}->entry->get_text() ne $msec->get_check_value($key)) { - $msec->config_check($key, $security_checks_value{$key}->entry->get_text()); - } + $msec->set_check($key, $security_checks_value{$key}->entry->get_text()); } + $msec->apply_checks; foreach my $domain (keys %options_values) { log::explanations("Setting msec functions related to $domain"); - foreach my $key (keys %{$options_values{$domain}}) { - my $opt = $options_values{$domain}{$key}; - $msec->config_function($key, $opt =~ /Combo/ ? $opt->entry->get_text() : $opt->get_text()); - } - } + foreach my $key (keys %{$options_values{$domain}}) { + my $opt = $options_values{$domain}{$key}; + $msec->set_function($key, $opt =~ /Combo/ ? $opt->entry->get_text() : $opt->get_text()); + } + } + $msec->apply_functions; log::explanations("Applying msec changes"); run_program::rooted($::prefix, "/usr/sbin/msec"); |