applications/calamares
2
0
Fork 0
mirror of https://github.com/parchlinux/calamares.git synced 2025-06-27 09:25:36 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

[initcpio] Improve security by making initramfs files not world-readable

Browse source
This commit is contained in:
Adriaan de Groot 2019-07-05 13:17:55 +02:00
parent 1a85435372
commit 5f6efd2822
1 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

22
src/modules/initcpio/InitcpioJob.cpp
View file

@ -23,6 +23,9 @@
#include "utils/UMask.h"
#include "utils/Variant.h"
#include <QDir>
#include <QFile>
InitcpioJob::InitcpioJob( QObject* parent )
: Calamares::CppJob( parent )
{
@ -37,12 +40,31 @@ InitcpioJob::prettyName() const
return tr( "Creating initramfs with mkinitcpio." );
}
static void
fixPermissions( const QDir& d )
{
for ( const auto& fi : d.entryInfoList( { "initramfs*" }, QDir::Files ) )
{
QFile f( fi.absoluteFilePath() );
if ( f.exists() )
{
cDebug() << "initcpio fixing permissions for" << f.fileName();
f.setPermissions( QFileDevice::ReadOwner | QFileDevice::WriteOwner );
}
}
}
Calamares::JobResult
InitcpioJob::exec()
{
CalamaresUtils::UMask m( CalamaresUtils::UMask::Safe );
QDir d( CalamaresUtils::System::instance()->targetPath( "/boot" ) );
if ( d.exists() )
{
fixPermissions( d );
}
cDebug() << "Updating initramfs with kernel" << m_kernel;
auto r = CalamaresUtils::System::instance()->targetEnvCommand(
{ "mkinitcpio", "-p", m_kernel }, QString(), QString(), 0 );