#!/bin/sh set -e package=debathena-linerva # # divert_link # # Ensures that the file is properly diverted to # .debathena-orig by this package, and becomes a # symbolic link to either .debathena (default) or # .debathena-orig. # # undivert_unlink # # Undoes the action of divert_link specified # above. # # Version: 2.1.1 PLUS DIVERT_LOCAL # ours=.debathena theirs=.debathena-orig divert_link() { prefix=$1 suffix=$2 file=$prefix$suffix ourfile=$prefix$ours$suffix theirfile=$prefix$theirs$suffix if ! dpkg-divert --list $package | \ grep -xFq "diversion of $file to $theirfile by $package"; then dpkg-divert --divert "$theirfile" --rename --package "$package" --add "$file" fi if [ ! -e "$file" ]; then ln -s "$(basename "$ourfile")" "$file" elif [ ! -L "$file" ] || \ [ "$(readlink "$file")" != "$(basename "$ourfile")" -a \ "$(readlink "$file")" != "$(basename "$theirfile")" ]; then echo "*** OMINOUS WARNING ***: $file is not linked to either $(basename "$ourfile") or $(basename "$theirfile")" >&2 fi } undivert_unlink() { prefix=$1 suffix=$2 file=$prefix$suffix ourfile=$prefix$ours$suffix theirfile=$prefix$theirs$suffix if [ ! -L "$file" ] || \ [ "$(readlink "$file")" != "$(basename "$ourfile")" -a \ "$(readlink "$file")" != "$(basename "$theirfile")" ]; then echo "*** OMINOUS WARNING ***: $file is not linked to either $(basename "$ourfile") or $(basename "$theirfile")" >&2 else rm -f "$file" fi if [ ! -e "$file" ]; then dpkg-divert --remove --rename --package "$package" "$file" else echo "Not removing diversion of $file by $package" >&2 fi } divert_local_setuid() { file=$1 ourfile="/root/private/$(basename $1)" if [ -e $file ]; then chmod -s "$file" fi if ! dpkg-divert --list $package | \ grep -xFq "diversion of $file to $ourfile by $package"; then dpkg-divert --divert "$ourfile" --rename --package "$package" --add "$file" fi } divert_lose_setuid() { file=$1 ourfile="/root/private/$(basename $1)" if [ -e $file ]; then chmod a-s "$file" fi if ! dpkg-divert --list $package | \ grep -xFq "diversion of $file to $ourfile by $package"; then dpkg-divert --divert "$ourfile" --package "$package" --add "$file" fi } divert_symlink() { # Use to symlink e.g /bin/fs -> /usr/bin/fs file=$1 if [ ! -e ${file} ]; then ln -s /usr${file} ${file} fi } case "$1" in configure) # Divert away all the default Debian versions so that ours can # be put in place. oldversion=$2 chmod 700 /root chmod 700 /usr/src chmod 700 /lib/modules chmod 700 /srv/old chmod 1777 /var/run/screen # fix elinks divert_link /usr/bin/elinks # Add motd divert_link /etc/motd # make motd not change on reboot sed -i 's/EDITMOTD=yes/EDITMOTD=no/' /etc/default/rcS # Use local nameserver divert_link /etc/resolv.conf # install id and manpage divert_link /usr/bin/id divert_link /usr/share/man/man1/id .1.gz divert_link /etc/security/limits.conf update-rc.d -f lpd remove update-rc.d -f lprng remove rm -f /etc/cron.daily/lprng mkdir -p /srv/tmp # Deal with binaries that are in /bin/athena on Athena and not # /bin in Debian divert_symlink /bin/aklog divert_symlink /bin/bos divert_symlink /bin/detach divert_symlink /bin/fs divert_symlink /bin/getcluster divert_symlink /bin/hesinfo divert_symlink /bin/klog divert_symlink /bin/pts # divert_symlink /bin/saferm divert_symlink /bin/tokens divert_symlink /bin/unlog divert_symlink /bin/vos # make sure /tmp is setup correctly. # ln -s /srv/tmp/ /tmp # chmod 777 /srv/tmp/ # chmod +t /srv/tmp/ # install /compat # fix-compat-suid # install discuss # replace logcheck config # make logcheck able to read its stuff and run every minute sed -i 's/. \* \* \* \*/* * * * */' /etc/cron.d/logcheck /etc/init.d/cron reload chown logcheck /var/lib/logcheck/ chown logcheck /var/lock/logcheck/ chmod 750 /etc/logcheck # configure logcheck reasonably. divert_link /etc/logcheck/logcheck.conf divert_link /etc/logcheck/ignore.d.server/kernel divert_link /etc/logcheck/ignore.d.server/perl divert_link /etc/logcheck/ignore.d.server/ssh divert_link /etc/logcheck/ignore.d.server/get_message divert_link /etc/logcheck/ignore.d.server/cron divert_link /etc/logcheck/ignore.d.server/fingerd divert_link /etc/logcheck/ignore.d.server/automount divert_link /etc/logcheck/ignore.d.server/gconfd divert_link /etc/logcheck/ignore.d.server/screen divert_link /etc/logcheck/violations.ignore.d/logcheck-automount divert_link /etc/logcheck/violations.ignore.d/logcheck-gconfd divert_link /etc/logcheck/violations.ignore.d/logcheck-get_message divert_link /etc/logcheck/violations.ignore.d/logcheck-kernel divert_link /etc/logcheck/violations.ignore.d/logcheck-perl divert_link /etc/logcheck/violations.ignore.d/logcheck-screen divert_link /etc/logcheck/violations.ignore.d/logcheck-ssh # slaughter-suid mkdir -p /root/private chmod 700 /root/private # divert_local_setuid is for removing setuid programs. # They will need to be upgraded manually in the future divert_local_setuid /usr/bin/newgrp divert_local_setuid /usr/bin/chage divert_local_setuid /usr/bin/expiry divert_local_setuid /usr/bin/dotlockfile divert_local_setuid /usr/bin/lockfile divert_local_setuid /usr/bin/ksu divert_local_setuid /usr/bin/sudo divert_local_setuid /usr/lib/pt_chown divert_local_setuid /usr/lib/emacs/21.4/i386-linux/movemail divert_local_setuid /usr/lib/ssh-keysign divert_local_setuid /usr/sbin/pppd divert_local_setuid /usr/sbin/pppoe divert_local_setuid /usr/sbin/utempter divert_local_setuid /usr/X11R6/bin/X divert_local_setuid /bin/su divert_local_setuid /bin/ping6 divert_local_setuid /sbin/unix_chkpwd divert_local_setuid /usr/bin/crontab divert_local_setuid /usr/bin/procmail divert_local_setuid /usr/bin/at # divert_lose_setuid is for making programs no longer setuid # while leaving them available. Need manual upgrades too if [ -e /usr/bin/chfn.debathena-orig ]; then chmod -s /usr/bin/chfn.debathena-orig else chmod -s /usr/bin/chfn fi if [ -e /usr/bin/chsh.debathena-orig ]; then chmod -s /usr/bin/chsh.debathena-orig else chmod -s /usr/bin/chsh fi divert_lose_setuid /usr/bin/passwd divert_lose_setuid /usr/bin/bsd-write divert_lose_setuid /usr/lib/libfakeroot-tcp.so.0.0.1 divert_lose_setuid /usr/lib/libfakeroot-sysv.so.0.0.1 divert_lose_setuid /usr/bin/gpg divert_lose_setuid /usr/bin/screen divert_lose_setuid /usr/bin/gpasswd divert_lose_setuid /bin/mount divert_lose_setuid /bin/umount divert_lose_setuid /usr/bin/ssh-agent divert_lose_setuid /bin/login divert_lose_setuid /usr/X11R6/bin/xterm divert_lose_setuid /usr/bin/wall echo "" echo "Displaying Current setuid binaries:" find / -xdev -perm +4000 -print 2> /dev/null ;; abort-upgrade|abort-remove|abort-deconfigure) ;; *) echo "postinst called with unknown argument '$1'" >&2 exit 0 ;; esac exit 0