From 33a1b6f6006a6481de1b59ee3a8d5c0706830b71 Mon Sep 17 00:00:00 2001
From: guoxiaoqi <guoxiaoqi2@huawei.com>
Date: Thu, 4 Mar 2021 09:31:35 +0800
Subject: [PATCH] do not create allow file while the command does not exist

Signed-off-by: guoxiaoqi <guoxiaoqi2@huawei.com>
---
 security-tool.sh | 35 +++++++++++++++++++++++++++++++++++
 security.conf    | 12 +++---------
 2 files changed, 38 insertions(+), 9 deletions(-)

diff --git a/security-tool.sh b/security-tool.sh
index c6bc4e7..60e25f8 100644
--- a/security-tool.sh
+++ b/security-tool.sh
@@ -675,6 +675,33 @@ function fn_handle_ln()
     return $?
 }
 
+#=============================================================================
+# Function Name: fn_handle_allow
+# Returns      : 0 on success, otherwise on fail
+#=============================================================================
+function fn_handle_allow()
+{
+    fn_test_params_num 1
+
+    local rpmname=$1
+    local ret=0
+
+    rpm -q "$rpmname"
+    if [ $? -eq 0 ]; then
+        local denyfile="$ROOTFS/etc/$rpmname.deny"
+        local allowfile="$ROOTFS/etc/$rpmname.allow"
+        rm -rf "$denyfile"
+        touch "$allowfile"
+        chown root:root "$allowfile"
+        chmod og-rwx "$allowfile"
+
+    else
+        ret=1
+        fn_error "package $rpmname does not exist"
+    fi
+
+    return $ret
+}
 
 #=============================================================================
 # Function Name: fn_harden_rootfs
@@ -759,6 +786,10 @@ function fn_harden_rootfs()
             fn_handle_ln "$f3" "$f4" "$f5"
             status=$?
             ;;
+        allow)
+            fn_handle_allow "$f3"
+            status=$?
+            ;;
         *)
             fn_handle_command "$f2" "$f3"
             status=$?
@@ -861,6 +892,10 @@ IFS=$PRE_IFS
             fn_handle_ln "$f3" "$f4" "$f5"
             status=$?
             ;;
+        allow)
+            fn_handle_allow "$f3"
+            status=$?
+            ;;
         *)
             fn_handle_command "$f2" "$f3"
             status=$?
diff --git a/security.conf b/security.conf
index 30b9f54..75b6ba3 100644
--- a/security.conf
+++ b/security.conf
@@ -140,15 +140,9 @@
 213@chown root:root @/etc/cron.monthly
 213@chmod og-rwx @/etc/cron.monthly
 
-214@rm -f @/etc/at.deny
-214@touch @/etc/at.allow
-214@chown root:root @/etc/at.allow
-214@chmod og-rwx @/etc/at.allow
-
-215@rm -f @/etc/cron.deny
-215@touch @/etc/cron.allow
-215@chown root:root @/etc/cron.allow
-215@chmod og-rwx @/etc/cron.allow
+# limit command permissions
+214@allow@at
+215@allow@cron
 
 #rpm initscripts drop /etc/sysconfig/init defaultly
 216@touch @/etc/sysconfig/init
-- 
1.8.3.1