mykola/freebsd-ports
1
0
Fork 0
forked from Lainports/freebsd-ports
Code Pull requests Activity

security/base-audit: Add the ability to specify ignored jails

Browse source 
security_status_baseaudit_jails_ignore is a space delimited list of jails
to ignore.

If non-empty, the code iterates over security_status_baseaudit_jails_ignore
to avoid partial matches (i.e. ignore foo.bar, but not foo). If there is a
better way to do that without looping, please let me know.

Example use case: I have jails which purposely are older vulnerable versions
for testing.

PR:		257685
Approved by:	000.fbsd@quip.cz (maintainer)
This commit is contained in:
Dan Langille 2021-08-10 02:01:00 +00:00
parent a01a684ed8
commit a5bd3edbfb
2 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
security/base-audit/Makefile
View file

@ -1,7 +1,7 @@
# Created by: Miroslav Lachman
PORTNAME= base-audit
PORTVERSION= 0.4
PORTVERSION= 0.5
CATEGORIES= security
MASTER_SITES= # none
DISTFILES= # none

14
security/base-audit/files/405.pkg-base-audit.in Normal file → Executable file
View file

@ -40,6 +40,7 @@ fi
: ${security_status_baseaudit_quiet:=NO}
: ${security_status_baseaudit_chroots=$pkg_chroots}
: ${security_status_baseaudit_jails=$pkg_jails}
: ${security_status_baseaudit_jails_ignore=""}
: ${security_status_baseaudit_expiry:=2}
# Compute PKG_DBDIR from the config file.
@ -166,6 +167,19 @@ audit_base_all() {
esac
for j in $jails ; do
# ignore some jails
if [ -n "$security_status_baseaudit_jails_ignore" ]; then
# we iterate to get exact matches because we want substring matches
# foo should not match foo.bar
for ignore in $security_status_baseaudit_jails_ignore ; do
if [ "${j%|*}" == "$ignore" ]; then
echo
echo "ignoring jail: ${j%|*}"
# continue with the main loop
continue 2
fi
done
fi
echo
echo "jail: ${j%|*}"
audit_base "-j ${j%|*}" ${j##*|}