prehistoric-systems/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2026-03-11 08:55:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge 181f59c2af into 52ed89ce35

Browse source
This commit is contained in:
⑆ Neved4 ⑈ 2026-02-21 02:25:39 -08:00 committed by GitHub
commit f0cac49b20
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 41 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
include/functions
View file

@ -90,6 +90,7 @@
# ReportManual Log manual actions to report file
# ReportSuggestion Add a suggestion to report file
# ReportWarning Add a warning and priority to report file
# RunCmdAsUser Run commands as a normal user instead of root
# SafeFile Security tests to perform on a file before using it
# SafePerms Check if a file has safe permissions
# SafeInput Test provided string to see if it contains unwanted characters
@ -3057,6 +3058,44 @@
}
################################################################################
# Name : RunCmdAsUser()
# Description : Run commands as a normal user instead of root
#
# Parameters : $@ = command arguments
# Returns : None (executes the command as the appropriate user)
# Notes : This allows dropping permissions for specific commands when
# lynis is invoked as root, preventing privilege escalation
# risks (CWE-250, CWE-271).
#
# By isolating privileged code and dropping said privileges as
# soon as possible, we can execute tools with their proper
# permissions, such as in the case of Homebrew.
#
# When available, we use `sudo` and `su`. For a strictly
# POSIX-compliant environment, a C implementation could be
# made using `setgid()` and `setuid()`.
################################################################################
################################################################################
RunCmdAsUser() {
case "$(id -u)" in
0)
if command -v sudo >/dev/null
then
sudo -u "$SUDO_USER" "$@"
elif command -v su >/dev/null
then
su "$(id -un)" -c "$@"
else
"$@"
fi
;;
*) "$@"
esac
}
################################################################################
# Name : SafeInput()
# Description : Test provided string to see if it contains unwanted characters

4
include/tests_ports_packages
View file

@ -126,7 +126,7 @@
LogText "Test: Querying brew to get package list"
Display --indent 4 --text "- Querying brew for installed packages"
LogText "Output:"; LogText "-----"
GPACKAGES=$(brew list --versions)
GPACKAGES=$(RunCmdAsUser brew list --versions)
while IFS= read -r PKG; do
PACKAGE_NAME=$(echo ${PKG} | ${CUTBINARY} -d ' ' -f1)
PACKAGE_VERSION=$(echo ${PKG} | ${CUTBINARY} -d ' ' -f2)
@ -182,7 +182,7 @@ EOF
PACKAGE_VERSION=$(defaults read "$CS/Contents/Info" CFBundleShortVersionString 2>/dev/null || echo "N/A")
LogText "Found CoreServices: ${PACKAGE_NAME} (version: ${PACKAGE_VERSION})"
INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${PACKAGE_NAME},${PACKAGE_VERSION}"
done
done
fi
#
#################################################################################