summaryrefslogtreecommitdiff
path: root/src/audit.c
AgeCommit message (Collapse)AuthorFilesLines
2017-02-15add support for pre and post commit hooksHenrik Riomar1-6/+3
This allows for instance integration of etckeeper [TT: Reorganized code a bit, and modified to use single directory commit_hooks.d with argument for script of stage.]
2015-06-01fix directory permissions loadingTimo Teräs1-1/+1
commit 941fc1b1 uncovered a bug that directory permissions are not updated properly at db load time if it's the default acl.
2015-04-17disable xattrs on symlinks for nowTimo Teräs1-1/+1
there's no nice syscall to manipulate xattrs with atfd and or open the symlink without dereferencing it (and having fd that we can do xattrs with)
2015-04-17make file install errors non-fatal, and xattr errors hiddenTimo Teräs1-1/+2
user xattrs on tmpfs are not supported no non-grsec kernels, and many times root fs is mounted without user_xattr. Thus to allow things to go smoothly on non-grsec kernels xattr unsupported errors are now hidden. xattrs can be fixed still now with "apk fix --xattrs"
2015-04-08ignore .apk-new files for overlaysTimo Teräs1-1/+5
2015-04-08audit xattrsTimo Teräs1-11/+17
ref #3027
2015-03-10rename file info related functions for consistencyTimo Teräs1-2/+2
2015-01-30remove spurious audit message from missing files with --systemTimo Teräs1-4/+2
fixes #3840
2014-11-01make 'mode, uid, gid' triplet separate atomized structTimo Teräs1-7/+5
there are only few combinations for that triplet, and they occur multiple times reducing the struct sizes a bit. make sane defaults and prepare to not write defaults to disk to reduce on-disk installed db size.
2014-10-08rework option parsing to have a group structureTimo Teräs1-15/+19
Add also a new 'commit' group that is the common options for all applets that can commit package changes.
2014-03-12audit: report missing files in system modeTimo Teräs1-21/+64
fixes #2113
2014-03-12audit: include all files in etc/apk in overlayTimo Teräs1-9/+18
This implements a new protected path flag '!' to include always matching entries in the backup mode (overlay). This is also turned on for etc/apk to include everything there in overlay, because the full list of repositories and signing keys need to be in overlay - just getting them from a package is not enough during bootstrap.
2013-06-19applets: unify help message by removing final dotsTimo Teräs1-3/+1
2013-06-18apk: use string array in applet mains, separate apk_name_foreach_matchingTimo Teräs1-21/+22
2013-06-14audit, index, search, upgrade: use foreach_array_itemTimo Teräs1-4/+3
2013-06-12libapk, apk(8): fix header inclusion issues with musl's headersWilliam Pitcock1-0/+1
2012-07-16audit: report new directories in recurse mode tooTimo Teräs1-12/+5
Add new 'd' flag for it.
2012-07-16audit: fix protection mask of non-db directoriesTimo Teräs1-23/+23
If a directory has protection mask, but does not exist in db, we do not handle it right unless we calculate the protection mask by hand, or create temporary db dir entry for it. For simplicity create always the db dir entry -- depending on audit type we likely need to create it anyway. This commit also caches the db dir entry in the audit tree context to avoid duplicate lookups. ref #1241.
2012-07-09audit: get right protection mask for base directories in the listsTimo Teräs1-6/+14
Use the paths' protection mask where available instead of the parent paths'. ref #1241
2012-05-01audit: apply protected_paths.d masks to individual filesTimo Teräs1-3/+18
2012-02-23audit, db: add etc/apk/protected_files.d and new audit featuresTimo Teräs1-128/+172
fixes #607. audit is now mostly rewritten for the new functionality. And has new features like --check-permissions, --recursive and --packages. $ROOT/etc/apk/protected_files.d/*.list can now contain additional protected paths, one path per line: +etc @etc/init.d -tmp + will include the directory as protected configuration directory. @ considers the directory protected, but will backup only symlinks. - removes any protection lbu should be modified to put include and exclude paths in etc/apk/protected_files.d/lbu.list. Additionally, some packages might provide their own listings. E.g. ssh might want to provide ssh.list with something like: +root/.ssh +home/*/.ssh
2012-02-14audit: check dirent mode, uid and gid if requestedTimo Teräs1-32/+71
2012-02-10db, fix: more secure way to choose effective directory permissionsTimo Teräs1-1/+5
And implement --directory-permissions for fix-applet to reset all directory uid, gid and modes.
2011-09-13all: update copyright year statementTimo Teräs1-1/+1
2010-06-11various: use O_CLOEXEC and add some error checkingTimo Teräs1-1/+1
2009-08-12db, pkg: separate structure for fields of installed packagesTimo Teras1-2/+4
this makes the database package entry smaller, and we propbably get more fields to installed_package later too. this cleans up the way scripts are stored and is a preparation for supporting triggers. some parsing for trigger meta-data. ref #45.
2009-08-06all: implement database open optionsTimo Teras1-15/+5
so user can override trusted keys directory and repositories file.
2009-08-06audit: do not load repositoriesTimo Teras1-2/+5
they are not needed, and cause errors if signing keys are not present.
2009-08-06audit: fix --backupTimo Teras1-1/+4
2009-08-05io: flag for following symlinks on fstatTimo Teras1-2/+2
usually we are interested on the actual file's length. but audit is interested about the link. so add a flag for this and use it in audit.
2009-07-31audit: sanitize --systemTimo Teras1-32/+79
make the system audit compare only installed files, instead of scanning the whole file system. also make it print only package names with -q, so reinstalling modified packages becomes easy.
2009-07-31apk: use *at instead of chdir+normal file syscallTimo Teras1-3/+4
this way we never change cwd, and relative filenames are always parsed consistently. this also helps filename construction in many places. this patch also changes '--root' to override location of all configuration to be in the new root. previously it depended on the file which one was used.
2009-07-30db: fix checksum storing to dbTimo Teras1-4/+3
also take precautions in audit code if the db is missing the checksum.
2009-07-30audit: protection mask for "symlinks only"Timo Teras1-0/+5
and use it for /etc/init.d by default. fixes #99.
2009-07-22audit: add --system optionTimo Teras1-15/+21
to check system files for changes.
2009-07-14db: live with sha1 and md5Timo Teras1-3/+5
this also convers scripts file to a tar archive.
2009-07-14db: speed up fdb creationTimo Teras1-4/+3
avoid recalculating hashes, and store the lengths of names, so we can optimize some operations.
2009-07-13io: move csumming away from bstream to gunzipTimo Teras1-13/+5
in future we want to checksum on gzip boundary basis, not the full file.
2009-06-25help: auto construct helpTimo Teras1-4/+6
And add some more verbosity to the help message.
2009-05-06change apk audit letters to correspond to old sfic/lbu lettersNatanael Copa1-2/+2
A = "added" U = "updated"
2009-01-17db: database locking and creation to part of opening itTimo Teras1-1/+1
Add flags field to db open call. Also make error reporting quite a bit more detailed.
2009-01-16info: only show package desc when --verboseNatanael Copa1-1/+1
also introduce apk_verbosity. --quiet reduce verbosity and --verbose increases it. Default verbosity is 1.
2009-01-14audit: new command to check changed filesTimo Teras1-0/+146
Currently only implement --backup to get list of (config) files in protected directories to backup. This also fixes a database corruption bug in database.c.
generated by cgit v1.2.3-60-g2f50 (git 2.42.0) at 2024-07-22 08:12:11 +0000