Added option to automatically enforce msec permissions on startup.

3 files changed, 10 insertions, 2 deletions

diff --git a/msec.init b/msec.init
index 399378c..1f20036 100755
--- a/msec.init
+++ b/msec.init
@@ -34,6 +34,10 @@ case "$1" in
 		gprintf "Setting and checking MSEC permissions"
 		/usr/sbin/msecperms -q
 		echo_success
+	elif [ "$ENABLE_STARTUP_PERMS" = "enforce" ]; then
+		gprintf "Setting and enforcing MSEC permissions"
+		/usr/sbin/msecperms -q
+		echo_success
 	fi
 	;;
   stop)
@@ -45,11 +49,15 @@ case "$1" in
 	else
 		gprintf "MSEC security policy on startup: disabled"
 	fi
+	echo
 	if [ "$ENABLE_STARTUP_PERMS" = "yes" ]; then
 		gprintf "MSEC permissions on startup: enabled"
+	elif [ "$ENABLE_STARTUP_PERMS" = "enforce" ]; then
+		gprintf "MSEC permissions on startup: enforced"
 	else
 		gprintf "MSEC permissions on startup: disabled"
 	fi
+	echo
 	;;
   restart)
 	$0 stop
diff --git a/src/msec/config.py b/src/msec/config.py
index c0042c2..0d9c292 100644
--- a/src/msec/config.py
+++ b/src/msec/config.py
@@ -109,7 +109,7 @@ SETTINGS =    {'BASE_LEVEL':                    ("libmsec.base_level",
                'SHELL_HISTORY_SIZE':            ("libmsec.set_shell_history_size",          ['*']),
                'SHELL_TIMEOUT':                 ("libmsec.set_shell_timeout",               ['*']),
                'ENABLE_STARTUP_MSEC':           ("libmsec.enable_startup_msec",             ['yes', 'no']),
-               'ENABLE_STARTUP_PERMS':          ("libmsec.enable_startup_perms",            ['yes', 'no']),
+               'ENABLE_STARTUP_PERMS':          ("libmsec.enable_startup_perms",            ['yes', 'no', 'enforce']),
                }
 # text for disabled options
 OPTION_DISABLED=_("System default")
diff --git a/src/msec/libmsec.py b/src/msec/libmsec.py
index f67ffdb..04dbdc9 100755
--- a/src/msec/libmsec.py
+++ b/src/msec/libmsec.py
@@ -1649,7 +1649,7 @@ class MSEC:
         pass
 
     def enable_startup_perms(self, param):
-        """Enforce MSEC file directory permissions on system startup"""
+        """Enforce MSEC file directory permissions on system startup. If this parameter is set to 'enforce', system permissions will be enforced automatically, according to system security settings."""
         pass