aboutsummaryrefslogtreecommitdiffstats
path: root/src/audit.c
Commit message (Collapse)AuthorAgeFilesLines
* add support for pre and post commit hooksHenrik Riomar2017-02-151-6/+3
| | | | | | | This allows for instance integration of etckeeper [TT: Reorganized code a bit, and modified to use single directory commit_hooks.d with argument for script of stage.]
* fix directory permissions loadingTimo Teräs2015-06-011-1/+1
| | | | | commit 941fc1b1 uncovered a bug that directory permissions are not updated properly at db load time if it's the default acl.
* disable xattrs on symlinks for nowTimo Teräs2015-04-171-1/+1
| | | | | | there's no nice syscall to manipulate xattrs with atfd and or open the symlink without dereferencing it (and having fd that we can do xattrs with)
* make file install errors non-fatal, and xattr errors hiddenTimo Teräs2015-04-171-1/+2
| | | | | | | | | user xattrs on tmpfs are not supported no non-grsec kernels, and many times root fs is mounted without user_xattr. Thus to allow things to go smoothly on non-grsec kernels xattr unsupported errors are now hidden. xattrs can be fixed still now with "apk fix --xattrs"
* ignore .apk-new files for overlaysTimo Teräs2015-04-081-1/+5
|
* audit xattrsTimo Teräs2015-04-081-11/+17
| | | | ref #3027
* rename file info related functions for consistencyTimo Teräs2015-03-101-2/+2
|
* remove spurious audit message from missing files with --systemTimo Teräs2015-01-301-4/+2
| | | | fixes #3840
* make 'mode, uid, gid' triplet separate atomized structTimo Teräs2014-11-011-7/+5
| | | | | | | there are only few combinations for that triplet, and they occur multiple times reducing the struct sizes a bit. make sane defaults and prepare to not write defaults to disk to reduce on-disk installed db size.
* rework option parsing to have a group structureTimo Teräs2014-10-081-15/+19
| | | | | Add also a new 'commit' group that is the common options for all applets that can commit package changes.
* audit: report missing files in system modeTimo Teräs2014-03-121-21/+64
| | | | fixes #2113
* audit: include all files in etc/apk in overlayTimo Teräs2014-03-121-9/+18
| | | | | | | | | This implements a new protected path flag '!' to include always matching entries in the backup mode (overlay). This is also turned on for etc/apk to include everything there in overlay, because the full list of repositories and signing keys need to be in overlay - just getting them from a package is not enough during bootstrap.
* applets: unify help message by removing final dotsTimo Teräs2013-06-191-3/+1
|
* apk: use string array in applet mains, separate apk_name_foreach_matchingTimo Teräs2013-06-181-21/+22
|
* audit, index, search, upgrade: use foreach_array_itemTimo Teräs2013-06-141-4/+3
|
* libapk, apk(8): fix header inclusion issues with musl's headersWilliam Pitcock2013-06-121-0/+1
|
* audit: report new directories in recurse mode tooTimo Teräs2012-07-161-12/+5
| | | | Add new 'd' flag for it.
* audit: fix protection mask of non-db directoriesTimo Teräs2012-07-161-23/+23
| | | | | | | | | If a directory has protection mask, but does not exist in db, we do not handle it right unless we calculate the protection mask by hand, or create temporary db dir entry for it. For simplicity create always the db dir entry -- depending on audit type we likely need to create it anyway. This commit also caches the db dir entry in the audit tree context to avoid duplicate lookups. ref #1241.
* audit: get right protection mask for base directories in the listsTimo Teräs2012-07-091-6/+14
| | | | | Use the paths' protection mask where available instead of the parent paths'. ref #1241
* audit: apply protected_paths.d masks to individual filesTimo Teräs2012-05-011-3/+18
|
* audit, db: add etc/apk/protected_files.d and new audit featuresTimo Teräs2012-02-231-128/+172
| | | | | | | | | | | | | | | | | | | | | | | | | | | fixes #607. audit is now mostly rewritten for the new functionality. And has new features like --check-permissions, --recursive and --packages. $ROOT/etc/apk/protected_files.d/*.list can now contain additional protected paths, one path per line: +etc @etc/init.d -tmp + will include the directory as protected configuration directory. @ considers the directory protected, but will backup only symlinks. - removes any protection lbu should be modified to put include and exclude paths in etc/apk/protected_files.d/lbu.list. Additionally, some packages might provide their own listings. E.g. ssh might want to provide ssh.list with something like: +root/.ssh +home/*/.ssh
* audit: check dirent mode, uid and gid if requestedTimo Teräs2012-02-141-32/+71
|
* db, fix: more secure way to choose effective directory permissionsTimo Teräs2012-02-101-1/+5
| | | | | And implement --directory-permissions for fix-applet to reset all directory uid, gid and modes.
* all: update copyright year statementTimo Teräs2011-09-131-1/+1
|
* various: use O_CLOEXEC and add some error checkingTimo Teräs2010-06-111-1/+1
|
* db, pkg: separate structure for fields of installed packagesTimo Teras2009-08-121-2/+4
| | | | | | | this makes the database package entry smaller, and we propbably get more fields to installed_package later too. this cleans up the way scripts are stored and is a preparation for supporting triggers. some parsing for trigger meta-data. ref #45.
* all: implement database open optionsTimo Teras2009-08-061-15/+5
| | | | so user can override trusted keys directory and repositories file.
* audit: do not load repositoriesTimo Teras2009-08-061-2/+5
| | | | | they are not needed, and cause errors if signing keys are not present.
* audit: fix --backupTimo Teras2009-08-061-1/+4
|
* io: flag for following symlinks on fstatTimo Teras2009-08-051-2/+2
| | | | | | usually we are interested on the actual file's length. but audit is interested about the link. so add a flag for this and use it in audit.
* audit: sanitize --systemTimo Teras2009-07-311-32/+79
| | | | | | make the system audit compare only installed files, instead of scanning the whole file system. also make it print only package names with -q, so reinstalling modified packages becomes easy.
* apk: use *at instead of chdir+normal file syscallTimo Teras2009-07-311-3/+4
| | | | | | | | this way we never change cwd, and relative filenames are always parsed consistently. this also helps filename construction in many places. this patch also changes '--root' to override location of all configuration to be in the new root. previously it depended on the file which one was used.
* db: fix checksum storing to dbTimo Teras2009-07-301-4/+3
| | | | | also take precautions in audit code if the db is missing the checksum.
* audit: protection mask for "symlinks only"Timo Teras2009-07-301-0/+5
| | | | and use it for /etc/init.d by default. fixes #99.
* audit: add --system optionTimo Teras2009-07-221-15/+21
| | | | to check system files for changes.
* db: live with sha1 and md5Timo Teras2009-07-141-3/+5
| | | | this also convers scripts file to a tar archive.
* db: speed up fdb creationTimo Teras2009-07-141-4/+3
| | | | | avoid recalculating hashes, and store the lengths of names, so we can optimize some operations.
* io: move csumming away from bstream to gunzipTimo Teras2009-07-131-13/+5
| | | | | in future we want to checksum on gzip boundary basis, not the full file.
* help: auto construct helpTimo Teras2009-06-251-4/+6
| | | | And add some more verbosity to the help message.
* change apk audit letters to correspond to old sfic/lbu lettersNatanael Copa2009-05-061-2/+2
| | | | | A = "added" U = "updated"
* db: database locking and creation to part of opening itTimo Teras2009-01-171-1/+1
| | | | | Add flags field to db open call. Also make error reporting quite a bit more detailed.
* info: only show package desc when --verboseNatanael Copa2009-01-161-1/+1
| | | | | | | also introduce apk_verbosity. --quiet reduce verbosity and --verbose increases it. Default verbosity is 1.
* audit: new command to check changed filesTimo Teras2009-01-141-0/+146
Currently only implement --backup to get list of (config) files in protected directories to backup. This also fixes a database corruption bug in database.c.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-06 11:19:40 +0000