From 8485a58b8bcc5205c18cf8c3f65386c9e70b7dd0 Mon Sep 17 00:00:00 2001 From: Dinko Korunic Date: Wed, 3 Jun 2009 13:24:11 +0200 Subject: [PATCH] - Grub shell workaroundovi (divertovi) za ExecShield (grub i grub-probe) --- debian/changelog | 6 ++++++ debian/install | 2 ++ debian/postinst | 47 ++++++++++++++++++++++------------------------- debian/postrm | 12 ++++++++++++ debian/preinst | 13 +++++++++++++ grub | 26 ++++++++++++++++++++++++++ grub-probe | 1 + 7 files changed, 82 insertions(+), 25 deletions(-) create mode 100755 grub create mode 120000 grub-probe diff --git a/debian/changelog b/debian/changelog index e562dcb..22f3afb 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +kernel-2.6-cn (3:2.6.26-3) stable; urgency=low + + * Grub shell workaroundovi (divertovi) za ExecShield (grub i grub-probe) + + -- Dinko Korunic Wed, 03 Jun 2009 13:19:06 +0200 + kernel-2.6-cn (3:2.6.26-2) stable; urgency=low * niz manjih izmjena u postinst rutinama za bolju detekciju root/boot diff --git a/debian/install b/debian/install index 07aa51a..60485e3 100644 --- a/debian/install +++ b/debian/install @@ -1 +1,3 @@ grub-functions.sh usr/share/kernel-2.6-cn +grub usr/sbin +grub-probe usr/sbin diff --git a/debian/postinst b/debian/postinst index 093c613..3b3d622 100755 --- a/debian/postinst +++ b/debian/postinst @@ -134,21 +134,24 @@ fi echo -n " grub2" # workaround grsec -if [ -x /sbin/chpax ]; then - if [ -x /usr/sbin/grub ]; then - chpax -spmrx /usr/sbin/grub || true +if uname -a | grep -q grsec; then + if [ -x /sbin/chpax ]; then + # grub + if [ -x /usr/sbin/grub.real ]; then + chpax -spmrx /usr/sbin/grub.real >/dev/null 2>&1 || true + elif [ -x /usr/sbin/grub ]; then + chpax -spmrx /usr/sbin/grub >/dev/null 2>&1 || true + fi + + # grub-probe + if [ -x /usr/sbin/grub-probe.real ]; then + chpax -spmrx /usr/sbin/grub-probe.real >/dev/null 2>&1 || true + elif [ -x /usr/sbin/grub-probe ]; then + chpax -spmrx /usr/sbin/grub-probe >/dev/null 2>&1 || true + fi + + echo -n " grsec" fi - if [ -x /usr/sbin/grub-probe ]; then - chpax -spmrx /usr/sbin/grub-probe || true - fi -fi -echo -n " grub3" - -# workaround execshield -SHIELD=$(sysctl -e -n kernel.exec-shield) -if [ ! -z "$SHIELD" ]; then - sysctl -e -w kernel.exec-shield=0 >/dev/null 2>&1 - echo -n " execshield1" fi # remove obsolete devfs/compat links and restore normal udev behaviour @@ -176,7 +179,7 @@ if [ ! -s "$device_map" ]; then else rm -f "$device_map.old" fi -echo -n " grub4" +echo -n " grub3" # import GRUB helper functions (again, updated device map) . /usr/share/kernel-2.6-cn/grub-functions.sh @@ -205,7 +208,7 @@ if [ -h "$install_device" ]; then || true fi fi -echo -n " grub5" +echo -n " grub4" # install GRUB loader if ! grub-install --no-floppy "$install_device" >/dev/null 2>&1; then @@ -214,7 +217,7 @@ if ! grub-install --no-floppy "$install_device" >/dev/null 2>&1; then echo "CN: Do not reboot your server and report this to OTRS immediately!" exit 1 fi -echo -n " grub6" +echo -n " grub5" # fix possible wrong params in menu.lst cp_check_and_sed '^# groot=' \ @@ -224,7 +227,7 @@ cp_check_and_sed '^# kopt=' \ "s;^# kopt=\(.*\)root=[^[:space:]]*\(.*\);# kopt=\1root=$root_device\2;g" \ "$menu_file" || true /usr/sbin/update-grub >/dev/null 2>&1 || true -echo -n " grub7" +echo -n " grub6" # and final stage of devfs/udev brokeness fix if [ "x$install_device_resolved" != "x$install_device" ]; then @@ -249,13 +252,7 @@ if [ "x$install_device_resolved" != "x$install_device" ]; then "s;\(^kernel.*\)root=[^[:space:]]*\(.*\);\1root=$root_device\2;g" \ "$menu_file" || true fi -echo -n " grub8" - -# restore execshield state -if [ ! -z "$SHIELD" ]; then - sysctl -e -w "kernel.exec-shield=$SHIELD" >/dev/null 2>&1 - echo -n " execshield2" -fi +echo -n " grub7" # disable lilo if [ -e /etc/lilo.conf ]; then diff --git a/debian/postrm b/debian/postrm index 5c733a3..13374b3 100755 --- a/debian/postrm +++ b/debian/postrm @@ -47,6 +47,18 @@ echo -n " modules" echo "." +################################################################################ + +DIVERT_TO="grub grub-probe" + +echo -n "CN: Undiverting binaries:" +for i in $DIVERT_TO; do + dpkg-divert --remove --rename --package 'kernel-2.6-cn' \ + --divert /usr/sbin/$i.real /usr/sbin/$i >/dev/null + echo -n " $i" +done +echo "." + # dh_installdeb will replace this with shell code automatically # generated by other debhelper scripts. diff --git a/debian/preinst b/debian/preinst index 6cc6e1f..cef0916 100755 --- a/debian/preinst +++ b/debian/preinst @@ -29,9 +29,22 @@ esac # make GRUB template directory if [ ! -d /boot/grub ]; then + echo "CN: Made /boot/grub directory." mkdir -p /boot/grub fi +################################################################################ + +DIVERT_TO="grub grub-probe" + +echo -n "CN: Diverting binaries:" +for i in $DIVERT_TO; do + dpkg-divert --add --rename --package 'kernel-2.6-cn' \ + --divert /usr/sbin/$i.real /usr/sbin/$i >/dev/null + echo -n " $i" +done +echo "." + # dh_installdeb will replace this with shell code automatically # generated by other debhelper scripts. diff --git a/grub b/grub new file mode 100755 index 0000000..b5fbe31 --- /dev/null +++ b/grub @@ -0,0 +1,26 @@ +#!/bin/sh +# Grub shell ExecShield wrapper +# +# Copyright (C) 2009 Dinko Korunic, CARNet, Grupa za izradu paketa +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at your +# option) any later version. + +SHIELD=$(sysctl -e -n kernel.exec-shield) +_retval=0 + +if [ ! -z "$SHIELD" ]; then + sysctl -e -w kernel.exec-shield=0 >/dev/null 2>&1 || true +fi + +if [ -x "$0.real" ]; then + "$0.real" $@ || _retval=$? +fi + +if [ ! -z "$SHIELD" ]; then + sysctl -e -w "kernel.exec-shield=$SHIELD" >/dev/null 2>&1 || true +fi + +exit $_retval diff --git a/grub-probe b/grub-probe new file mode 120000 index 0000000..2c8276e --- /dev/null +++ b/grub-probe @@ -0,0 +1 @@ +grub \ No newline at end of file -- 1.7.10.4