summaryrefslogtreecommitdiff
path: root/src/audit.c
AgeCommit message (Collapse)AuthorFilesLines
2012-02-23audit, db: add etc/apk/protected_files.d and new audit featuresTimo Teräs1-128/+172
fixes #607. audit is now mostly rewritten for the new functionality. And has new features like --check-permissions, --recursive and --packages. $ROOT/etc/apk/protected_files.d/*.list can now contain additional protected paths, one path per line: +etc @etc/init.d -tmp + will include the directory as protected configuration directory. @ considers the directory protected, but will backup only symlinks. - removes any protection lbu should be modified to put include and exclude paths in etc/apk/protected_files.d/lbu.list. Additionally, some packages might provide their own listings. E.g. ssh might want to provide ssh.list with something like: +root/.ssh +home/*/.ssh
2012-02-14audit: check dirent mode, uid and gid if requestedTimo Teräs1-32/+71
2012-02-10db, fix: more secure way to choose effective directory permissionsTimo Teräs1-1/+5
And implement --directory-permissions for fix-applet to reset all directory uid, gid and modes.
2011-09-13all: update copyright year statementTimo Teräs1-1/+1
2010-06-11various: use O_CLOEXEC and add some error checkingTimo Teräs1-1/+1
2009-08-12db, pkg: separate structure for fields of installed packagesTimo Teras1-2/+4
this makes the database package entry smaller, and we propbably get more fields to installed_package later too. this cleans up the way scripts are stored and is a preparation for supporting triggers. some parsing for trigger meta-data. ref #45.
2009-08-06all: implement database open optionsTimo Teras1-15/+5
so user can override trusted keys directory and repositories file.
2009-08-06audit: do not load repositoriesTimo Teras1-2/+5
they are not needed, and cause errors if signing keys are not present.
2009-08-06audit: fix --backupTimo Teras1-1/+4
2009-08-05io: flag for following symlinks on fstatTimo Teras1-2/+2
usually we are interested on the actual file's length. but audit is interested about the link. so add a flag for this and use it in audit.
2009-07-31audit: sanitize --systemTimo Teras1-32/+79
make the system audit compare only installed files, instead of scanning the whole file system. also make it print only package names with -q, so reinstalling modified packages becomes easy.
2009-07-31apk: use *at instead of chdir+normal file syscallTimo Teras1-3/+4
this way we never change cwd, and relative filenames are always parsed consistently. this also helps filename construction in many places. this patch also changes '--root' to override location of all configuration to be in the new root. previously it depended on the file which one was used.
2009-07-30db: fix checksum storing to dbTimo Teras1-4/+3
also take precautions in audit code if the db is missing the checksum.
2009-07-30audit: protection mask for "symlinks only"Timo Teras1-0/+5
and use it for /etc/init.d by default. fixes #99.
2009-07-22audit: add --system optionTimo Teras1-15/+21
to check system files for changes.
2009-07-14db: live with sha1 and md5Timo Teras1-3/+5
this also convers scripts file to a tar archive.
2009-07-14db: speed up fdb creationTimo Teras1-4/+3
avoid recalculating hashes, and store the lengths of names, so we can optimize some operations.
2009-07-13io: move csumming away from bstream to gunzipTimo Teras1-13/+5
in future we want to checksum on gzip boundary basis, not the full file.
2009-06-25help: auto construct helpTimo Teras1-4/+6
And add some more verbosity to the help message.
2009-05-06change apk audit letters to correspond to old sfic/lbu lettersNatanael Copa1-2/+2
A = "added" U = "updated"
2009-01-17db: database locking and creation to part of opening itTimo Teras1-1/+1
Add flags field to db open call. Also make error reporting quite a bit more detailed.
2009-01-16info: only show package desc when --verboseNatanael Copa1-1/+1
also introduce apk_verbosity. --quiet reduce verbosity and --verbose increases it. Default verbosity is 1.
2009-01-14audit: new command to check changed filesTimo Teras1-0/+146
Currently only implement --backup to get list of (config) files in protected directories to backup. This also fixes a database corruption bug in database.c.