/usr/lib/tiger/systems/Linux/2/check_rcumask is in tiger 1:3.2.3-10.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 | #!/bin/sh
#
# tiger - A UN*X security checking system
# Copyright (C) 2002 Javier Fernandez-Sanguino Pen~a
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# Please see the file `COPYING' for the complete copyright notice.
#
# check_rcumask - Sat May 18 17:50:00 CEST 2002
#
# check_rcumask - 05/21/2009 - jfs - Remove shell login umasks and add Debian's /etc/init.d/rc.
# Adjust haveallcmds definition
# check_rcumask - 06/23/2007 - jfs - Fix syntax error (Debian bug #430224)
# check_rcumask - 06/21/2007 - jfs - Skip comment lines (Debian bug #418531)
# check_rcumask - 05/20/2006 - jfs - Use TAIL properly (POSIX 1003.2-1992)
# check_rcumask - 10/15/2004 - jfs - Proper warning if no umask settings
# are defined (Debian bug #234661)
# check_rcumask - 10/15/2003 - jfs - Removed bashishm (Debian bug #215896)
# check_rcumask - 07/25/2002 - jfs
# Changed TigerInstallDir to .
# check_rcumask - 09/10/2002 - jfs
# Fixed to work in sh properly (and added necessary checks)
# check_rcumask - 08/09/2003 - jfs
# Included patch to check for more source files
#
# Checks if there is a umask setting for the init.d scripts (rc) so that
# the init scripts create files with a proper mode (umask 022 so that files
# are created at least with 0644 permissions).
#
# Done based on scripts/check_logfiles (since the code to look for umasks
# is there already). The code is included only on Linux scripts since it
# has not been tested in other environments.
#
#-----------------------------------------------------------------------------
#
TigerInstallDir="/usr/lib/tiger"
#
# Set default base directory.
# Order or preference:
# -B option
# TIGERHOMEDIR environment variable
# TigerInstallDir installed location
#
basedir=${TIGERHOMEDIR:=$TigerInstallDir}
for parm
do
case $parm in
-B) basedir=$2; break;;
esac
done
#
# Verify that a config file exists there, and if it does
# source it.
#
[ ! -r $basedir/config ] && {
echo "--ERROR-- [init002e] No 'config' file in \`$basedir'."
exit 1
}
. $basedir/config
. $BASEDIR/initdefs
#
# If run in test mode (-t) this will verify that all required
# elements are set.
#
[ "$Tiger_TESTMODE" = 'Y' ] && {
haveallcmds HEAD TAIL GREP EXPAND SED CUT || exit 1
haveallfiles BASEDIR WORKDIR || exit 1
haveallvars TESTLINK HOSTNAME
echo "--CONFIG-- [init003c] $0: Configuration ok..."
exit 0
}
#------------------------------------------------------------------------
echo
echo "# Checking for correct umask settings for init scripts..."
haveallcmds HEAD TAIL GREP EXPAND SED CUT || exit 1
#####
# Check various possible files
#####
Foundumask=0
# Files include Debian's rc and rcS, Titan's umask.sh file and Red Hat default
# source for initscripts: /etc/rc.d/init.d/functions
for file in '/etc/init.d/rcS' '/etc/rc.d/init.d/umask.sh' '/etc/init.d/umask.sh' '/etc/rc.d/init.d/functions' '/etc/init.d/rc'
do
[ -r $file ] && {
Occurance=`$GREP umask $file |$GREP -v ^# | $WC -l`
if [ $Occurance -eq 1 ]; then
Foundumask=1
UMASK1=`$GREP umask $file \
| $GREP -v ^\# \
| $EXPAND \
| $SED -e "s/^.*umask//"\
| $CUT -d" " -f2`
[ "$UMASK1" != "002" -a "$UMASK1" != "022" ] &&
message FAIL misc017f '' "The umask setting in $file for the init scripts is insecure"
elif [ "$Occurance" = 2 ]; then
Foundumask=1
UMASK1=`$GREP umask $file \
| $GREP -v ^# \
| $EXPAND \
| $HEAD -n 1 \
| $SED -e "s/^.*umask//" \
| $CUT -d" " -f2`
UMASK2=`$GREP umask $file \
| $GREP -v ^# \
| $EXPAND \
| $TAIL -n 1 \
| $SED -e "s/^.*umask//" \
| $CUT -d" " -f2`
[ "$UMASK1" != "002" -a "$UMASK1" != "022" -o "$UMASK2" != "002" -a "$UMASK2" != "022" ] &&
message FAIL misc017f '' "The umask setting in $file for the init scripts is insecure"
elif [ "$Occurance" = 0 ]; then
message WARN misc021w "" "There are no umask entries in $file"
else
message WARN misc018w '' "There are more than 2 umask entries in $file"
fi
}
done
if [ "$Foundumask" -eq 0 ]; then
message WARN misc019w "" "There are no umask settings for init.d scripts"
fi
|