Skip to content

Commit bf68b28

Browse files
Merge pull request #3 from derlaft/master
Nonroot config field is actually optional; comments in configuration files
2 parents f8df668 + 865273c commit bf68b28

File tree

4 files changed

+67
-82
lines changed

4 files changed

+67
-82
lines changed

README.md

+2-4
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,10 @@ The following is an example configuration:
3636
```json
3737
{
3838
"/usr/lib/iceweasel/iceweasel": {
39-
"flags": "pm",
40-
"nonroot": false
39+
"flags": "pm"
4140
},
4241
"/usr/lib/iceweasel/plugin-container": {
43-
"flags": "m",
44-
"nonroot": false
42+
"flags": "m"
4543
},
4644
"/home/user/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/firefox": {
4745
"flags": "pm",

paxrat.conf

+24-48
Original file line numberDiff line numberDiff line change
@@ -1,97 +1,73 @@
11
{ "/usr/bin/gnome-shell": {
2-
"flags": "mr",
3-
"nonroot": false
2+
"flags": "mr"
43
},
54
"/usr/lib/gnome-session/gnome-session-check-accelerated": {
6-
"flags": "m",
7-
"nonroot": false
5+
"flags": "m"
86
},
97
"/usr/lib/gnome-session/gnome-session-check-accelerated-helper": {
10-
"flags": "m",
11-
"nonroot": false
8+
"flags": "m"
129
},
1310
"/usr/lib/gnome-session/gnome-session-failed": {
14-
"flags": "m",
15-
"nonroot": false
11+
"flags": "m"
1612
},
1713
"/usr/bin/seahorse": {
18-
"flags": "m",
19-
"nonroot": false
14+
"flags": "m"
2015
},
2116
"/usr/bin/grub-bios-setup": {
22-
"flags": "E",
23-
"nonroot": false
17+
"flags": "E"
2418
},
2519
"/usr/sbin/grub-mkdevicemap": {
26-
"flags": "E",
27-
"nonroot": false
20+
"flags": "E"
2821
},
2922
"/usr/sbin/grub-probe": {
30-
"flags": "E",
31-
"nonroot": false
23+
"flags": "E"
3224
},
3325
"/usr/bin/grub-script-check": {
34-
"flags": "E",
35-
"nonroot": false
26+
"flags": "E"
3627
},
3728
"/usr/bin/grub-mount": {
38-
"flags": "m",
39-
"nonroot": false
29+
"flags": "m"
4030
},
4131
"/usr/sbin/grub-probe": {
42-
"flags": "m",
43-
"nonroot": false
32+
"flags": "m"
4433
},
4534
"/usr/bin/mplayer": {
46-
"flags": "m",
47-
"nonroot": false
35+
"flags": "m"
4836
},
4937
"/usr/bin/python2": {
50-
"flags": "m",
51-
"nonroot": false
38+
"flags": "m"
5239
},
5340
"/usr/bin/python3": {
54-
"flags": "m",
55-
"nonroot": false
41+
"flags": "m"
5642
},
5743
"/usr/bin/vlc": {
58-
"flags": "m",
59-
"nonroot": false
44+
"flags": "m"
6045
},
6146
"/usr/lib/libreoffice/program/soffice.bin": {
62-
"flags": "m",
63-
"nonroot": false
47+
"flags": "m"
6448
},
6549
"/usr/lib/openoffice/program/unopkg.bin": {
66-
"flags": "m",
67-
"nonroot": false
50+
"flags": "m"
6851
},
6952
"/usr/lib/policy-kit-1/polkitd": {
70-
"flags": "mr",
71-
"nonroot": false
53+
"flags": "mr"
7254
},
7355
"/usr/lib/jvm/java-7-openjdk-amd64/jre/bin/java": {
74-
"flags": "mr",
75-
"nonroot": false
56+
"flags": "mr"
7657
},
7758
"/usr/lib/jvm/java-7-openjdk-amd64/bin/javac": {
78-
"flags": "mr",
79-
"nonroot": false
59+
"flags": "mr"
8060
},
8161
"/usr/lib/jvm/java-7-openjdk-amd64/bin/jar": {
82-
"flags": "m",
83-
"nonroot": false
62+
"flags": "m"
8463
},
8564
"/usr/bin/gdbus": {
86-
"flags": "mr",
87-
"nonroot": false
65+
"flags": "mr"
8866
},
8967
"/usr/lib/iceweasel/iceweasel": {
90-
"flags": "pm",
91-
"nonroot": false
68+
"flags": "pm"
9269
},
9370
"/usr/lib/iceweasel/plugin-container": {
94-
"flags": "m",
95-
"nonroot": false
71+
"flags": "m"
9672
}
9773
}

paxrat.go

+29-17
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,46 @@
11
package main
22

33
import (
4-
"flag"
5-
"io/ioutil"
4+
"bufio"
65
"encoding/json"
7-
"regexp"
6+
"flag"
87
"fmt"
98
"log"
109
"log/syslog"
11-
"syscall"
1210
"os"
1311
"os/exec"
1412
"os/user"
1513
"path/filepath"
14+
"regexp"
1615
"strings"
16+
"syscall"
1717

1818
"golang.org/x/exp/inotify"
1919
)
2020

21-
2221
var configvar string
2322
var testvar bool
2423
var watchvar bool
2524
var flagsvar string
2625
var binaryvar string
2726
var nonrootvar bool
27+
2828
type Setting struct {
29-
Flags string `json:"flags"`
30-
Nonroot bool `json:"nonroot"`
29+
Flags string `json:"flags"`
30+
Nonroot bool `json:"nonroot,omitempty"`
3131
}
3232
type Config struct {
3333
Settings map[string]Setting
3434
}
35+
3536
var InotifyFlags uint32
3637
var InotifyDirFlags uint32
3738
var Conf *Config
3839
var LogWriter *syslog.Writer
3940
var SyslogError error
4041

42+
var commentRegexp = regexp.MustCompile("^[ \t]*#")
43+
4144
func init() {
4245
LogWriter, SyslogError = syslog.New(syslog.LOG_INFO, "paxrat")
4346
if SyslogError != nil {
@@ -55,7 +58,7 @@ func init() {
5558
"Test the config file and then exit")
5659
flag.BoolVar(&watchvar, "w", false,
5760
"Run paxrat in watch mode")
58-
flag.StringVar(&flagsvar, "s", "",
61+
flag.StringVar(&flagsvar, "s", "",
5962
"Set PaX flags for a single binary (must also specify binary)")
6063
flag.BoolVar(&nonrootvar, "n", false,
6164
"Set nonroot variable for a single binary (needed to set flags on a non-root owned binary")
@@ -64,12 +67,21 @@ func init() {
6467
}
6568

6669
func (conf *Config) readConfig(path string) (err error) {
67-
file, err := ioutil.ReadFile(path)
70+
file, err := os.Open(path)
6871
if err != nil {
6972
log.Fatal(err)
7073
}
74+
scanner := bufio.NewScanner(file)
75+
out := ""
76+
for scanner.Scan() {
77+
line := scanner.Text()
78+
if !commentRegexp.MatchString(line) {
79+
out += line + "\n"
80+
}
81+
82+
}
7183
var data = &conf.Settings
72-
err = json.Unmarshal(file, data)
84+
err = json.Unmarshal([]byte(out), data)
7385
if err != nil {
7486
log.Fatal(err)
7587
}
@@ -85,8 +97,8 @@ func pathExists(path string) (result bool) {
8597

8698
func validateFlags(flags string) (err error) {
8799
match, _ := regexp.MatchString("(?i)[^pemrxs]", flags)
88-
if match {
89-
err = fmt.Errorf("Bad characters found in PaX flags: %s",
100+
if match {
101+
err = fmt.Errorf("Bad characters found in PaX flags: %s",
90102
flags)
91103
}
92104
return
@@ -139,10 +151,10 @@ func setFlags(path string, flags string, nonroot bool) (err error) {
139151
}
140152
linkUid := fiPath.Sys().(*syscall.Stat_t).Uid
141153
// Throw error if nonroot option is not set but the file is owned by a user other than root
142-
if (!nonroot && linkUid > 0) {
154+
if !nonroot && linkUid > 0 {
143155
err = fmt.Errorf(
144156
"Cannot set PaX flags on %s. Owner of symlink did not match owner of symlink target\n",
145-
path)
157+
path)
146158
return
147159
}
148160
// Resolve the symlink target
@@ -159,7 +171,7 @@ func setFlags(path string, flags string, nonroot bool) (err error) {
159171
}
160172
targetUid := fiRPath.Sys().(*syscall.Stat_t).Uid
161173
// If nonroot is set then throw an error if the owner of the file is different than the owner of the symlink target
162-
if (nonroot && targetUid != linkUid) {
174+
if nonroot && targetUid != linkUid {
163175
err = fmt.Errorf(
164176
"Cannot set PaX flags on %s. Owner of symlink did not match owner of symlink target\n",
165177
path)
@@ -188,7 +200,7 @@ func setFlagsWatchMode(watcher *inotify.Watcher, path string, flags string, nonr
188200
watcher.RemoveWatch(path)
189201
setFlags(path, flags, nonroot)
190202
if err != nil {
191-
return(err)
203+
return (err)
192204
}
193205
addWatchToClosestPath(watcher, path)
194206
return
@@ -303,7 +315,7 @@ func runWatcher(watcher *inotify.Watcher) {
303315
msg := fmt.Sprintf("File created: %s\n", ev.Name)
304316
LogWriter.Info(msg)
305317
}
306-
// Catch directory creation events for non-existent directories in executable path
318+
// Catch directory creation events for non-existent directories in executable path
307319
} else if ev.Mask == (inotify.IN_CREATE | inotify.IN_ISDIR) {
308320
for path, _ := range (*Conf).Settings {
309321
if strings.HasPrefix(path, ev.Name) {

paxrat_test.go

+12-13
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
package main
22

33
import (
4+
"fmt"
45
"io/ioutil"
56
"os"
67
"testing"
7-
"fmt"
88
"time"
99
)
1010

@@ -30,12 +30,12 @@ func TestRunWatcher1(t *testing.T) {
3030
}
3131
}
3232
testJson := fmt.Sprintf(
33-
"{\"%s/test1\": {" +
34-
"\"flags\": \"mr\"," +
35-
"\"nonroot\": false}," +
36-
"\"%s/test2\": {" +
37-
"\"flags\": \"E\"," +
38-
"\"nonroot\": false}}", dir, dir)
33+
`{"%s/test1": {`+
34+
`"flags": "mr",`+
35+
`"nonroot": false},`+
36+
`"%s/test2": {`+
37+
`"flags": "E",`+
38+
`"nonroot": false}}`, dir, dir)
3939
configPath := dir + "paxrat_conf.json"
4040
Conf = new(Config)
4141
err = createTestConfig(configPath, testJson)
@@ -58,7 +58,7 @@ func TestRunWatcher1(t *testing.T) {
5858
if err != nil {
5959
t.Fatalf("Could not remove testFile1: %s", err)
6060
}
61-
err = os.Rename(files[1], dir + "moved")
61+
err = os.Rename(files[1], dir+"moved")
6262
if err != nil {
6363
t.Fatalf("Could not move/rename TestFile2: %s", err)
6464
}
@@ -76,9 +76,9 @@ func TestRunWatcher2(t *testing.T) {
7676
}
7777
defer os.RemoveAll(dir)
7878
testJson := fmt.Sprintf(
79-
"{\"%s/1/2/3/4/5/6/7/8/9/10/test1\": {" +
80-
"\"flags\": \"mr\"," +
81-
"\"nonroot\": false}}", dir)
79+
`{"%s/1/2/3/4/5/6/7/8/9/10/test1": {`+
80+
`"flags": "mr",`+
81+
`"nonroot": false}}`, dir)
8282
configPath := dir + "paxrat_conf.json"
8383
Conf = new(Config)
8484
err = createTestConfig(configPath, testJson)
@@ -99,7 +99,7 @@ func TestRunWatcher2(t *testing.T) {
9999
runWatcher(watcher)
100100
}(done)
101101
time.Sleep(1 * time.Second)
102-
os.MkdirAll(dir + "/1/2/3/4/5/6/7/8/9/10", 0600 )
102+
os.MkdirAll(dir+"/1/2/3/4/5/6/7/8/9/10", 0600)
103103
time.Sleep(1 * time.Second)
104104
file := dir + "/1/2/3/4/5/6/7/8/9/10/test1"
105105
fmt.Printf("Creating test file: %s", file)
@@ -108,4 +108,3 @@ func TestRunWatcher2(t *testing.T) {
108108
t.Fatalf("creating test file: %s", err)
109109
}
110110
}
111-

0 commit comments

Comments
 (0)