Have greenbone-nvt-sync not run as root #323
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This make greenbone-nvt-sync to be installed in regular bin directory because no root permissions are necessary anymore for unning the synchronisation.
mattmundell
suggested changes
May 11, 2019
tools/greenbone-nvt-sync.in
Outdated
| @@ -20,6 +20,16 @@ | |||
| # This script updates the local Network Vulnerability Tests (NVTs) from the | |||
| # Greenbone Security Feed (GSF) or the Greenbone Community Feed (GCF). | |||
|
|
|||
| if [ "`id -u`" -eq "0" ] | |||
| then | |||
| echo "$0 must not be executed as privileged user root" | |||
There was a problem hiding this comment.
I think this should go to stderr.
Maybe also relevant, almost all the other error exits also do a log_err (and use stderr_write instead of echo).
There was a problem hiding this comment.
I changed this accordingly.
Write the message about denied root execution to stderr instead of stdout. Also add a additional errir message to the log.
mattmundell
approved these changes
May 13, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The script greenbone-nvt-sync does not require anymore
root privileges to run. Therefore it is now installed
in the "bin" directory rather than the "sbin" directory.
Furthermore the script will now deny to run with "root"
privileges. This is to prevent accidental change of
file permissions that can later not be fixed by
non-priviledged user anymore.
If migrating from an older version, the owner and permissions
in the feed directory need to be fixed:
where the user that runs the sync needs to be
or belong to group .