apk-tools/src/audit.c, branch v2.3.2 Alpine Package Keeper, the 2.x tree https://git-old.alpinelinux.org/apk-tools/atom?h=v2.3.2 2012-07-16T13:34:35Z audit: report new directories in recurse mode too 2012-07-16T13:34:35Z Timo Teräs timo.teras@iki.fi 2012-07-16T13:34:35Z urn:sha1:0999ec9533688ac54b332b90d238a5801c9ee6f7 Add new 'd' flag for it. audit: fix protection mask of non-db directories 2012-07-16T11:44:15Z Timo Teräs timo.teras@iki.fi 2012-07-16T11:44:15Z urn:sha1:ea5b08d1d574ae90ad6347a4d2f0a69bb656c7af If a directory has protection mask, but does not exist in db, we do not handle it right unless we calculate the protection mask by hand, or create temporary db dir entry for it. For simplicity create always the db dir entry -- depending on audit type we likely need to create it anyway. This commit also caches the db dir entry in the audit tree context to avoid duplicate lookups. ref #1241. audit: get right protection mask for base directories in the lists 2012-07-09T11:59:40Z Timo Teräs timo.teras@iki.fi 2012-07-09T11:59:40Z urn:sha1:5aa69984595c8f63899a39cbeae8c86913bfb2d2 Use the paths' protection mask where available instead of the parent paths'. ref #1241 audit: apply protected_paths.d masks to individual files 2012-05-01T12:40:31Z Timo Teräs timo.teras@iki.fi 2012-05-01T12:40:31Z urn:sha1:c9a43a14697fa955f31e495a8b03a523975ad285 audit, db: add etc/apk/protected_files.d and new audit features 2012-02-23T13:05:06Z Timo Teräs timo.teras@iki.fi 2012-02-23T13:05:06Z urn:sha1:ba3ee3f86396f05123f732da7c7879c8ed016c9d fixes #607. audit is now mostly rewritten for the new functionality. And has new features like --check-permissions, --recursive and --packages. $ROOT/etc/apk/protected_files.d/*.list can now contain additional protected paths, one path per line: +etc @etc/init.d -tmp + will include the directory as protected configuration directory. @ considers the directory protected, but will backup only symlinks. - removes any protection lbu should be modified to put include and exclude paths in etc/apk/protected_files.d/lbu.list. Additionally, some packages might provide their own listings. E.g. ssh might want to provide ssh.list with something like: +root/.ssh +home/*/.ssh audit: check dirent mode, uid and gid if requested 2012-02-14T14:31:40Z Timo Teräs timo.teras@iki.fi 2012-02-14T14:31:40Z urn:sha1:ab20d618329f481d05fd9f1a94bfd2b6bbd5389c db, fix: more secure way to choose effective directory permissions 2012-02-10T14:40:01Z Timo Teräs timo.teras@iki.fi 2012-02-10T14:40:01Z urn:sha1:9ac8d8710229315b2e481fb99cec3ebc1852ea4f And implement --directory-permissions for fix-applet to reset all directory uid, gid and modes. all: update copyright year statement 2011-09-13T08:53:01Z Timo Teräs timo.teras@iki.fi 2011-09-13T08:53:01Z urn:sha1:1817b0a3c3ebd57e5332a80c15c70c46ec3eb8c0 various: use O_CLOEXEC and add some error checking 2010-06-11T10:42:21Z Timo Teräs timo.teras@iki.fi 2010-06-11T10:42:21Z urn:sha1:43cb554c3fd94ba394b708265c5fa2225a37a9eb db, pkg: separate structure for fields of installed packages 2009-08-12T16:17:46Z Timo Teras timo.teras@iki.fi 2009-08-12T16:17:46Z urn:sha1:36b5cee98b1e80a493d291e9bffa1ed120ed908a this makes the database package entry smaller, and we propbably get more fields to installed_package later too. this cleans up the way scripts are stored and is a preparation for supporting triggers. some parsing for trigger meta-data. ref #45.