summaryrefslogtreecommitdiff
path: root/src/audit.c
AgeCommit message (Collapse)AuthorFilesLines
2012-07-16audit: report new directories in recurse mode tooTimo Teräs1-12/+5
Add new 'd' flag for it.
2012-07-16audit: fix protection mask of non-db directoriesTimo Teräs1-23/+23
If a directory has protection mask, but does not exist in db, we do not handle it right unless we calculate the protection mask by hand, or create temporary db dir entry for it. For simplicity create always the db dir entry -- depending on audit type we likely need to create it anyway. This commit also caches the db dir entry in the audit tree context to avoid duplicate lookups. ref #1241.
2012-07-09audit: get right protection mask for base directories in the listsTimo Teräs1-6/+14
Use the paths' protection mask where available instead of the parent paths'. ref #1241
2012-05-01audit: apply protected_paths.d masks to individual filesTimo Teräs1-3/+18
2012-02-23audit, db: add etc/apk/protected_files.d and new audit featuresTimo Teräs1-128/+172
fixes #607. audit is now mostly rewritten for the new functionality. And has new features like --check-permissions, --recursive and --packages. $ROOT/etc/apk/protected_files.d/*.list can now contain additional protected paths, one path per line: +etc @etc/init.d -tmp + will include the directory as protected configuration directory. @ considers the directory protected, but will backup only symlinks. - removes any protection lbu should be modified to put include and exclude paths in etc/apk/protected_files.d/lbu.list. Additionally, some packages might provide their own listings. E.g. ssh might want to provide ssh.list with something like: +root/.ssh +home/*/.ssh
2012-02-14audit: check dirent mode, uid and gid if requestedTimo Teräs1-32/+71
2012-02-10db, fix: more secure way to choose effective directory permissionsTimo Teräs1-1/+5
And implement --directory-permissions for fix-applet to reset all directory uid, gid and modes.
2011-09-13all: update copyright year statementTimo Teräs1-1/+1
2010-06-11various: use O_CLOEXEC and add some error checkingTimo Teräs1-1/+1
2009-08-12db, pkg: separate structure for fields of installed packagesTimo Teras1-2/+4
this makes the database package entry smaller, and we propbably get more fields to installed_package later too. this cleans up the way scripts are stored and is a preparation for supporting triggers. some parsing for trigger meta-data. ref #45.
2009-08-06all: implement database open optionsTimo Teras1-15/+5
so user can override trusted keys directory and repositories file.
2009-08-06audit: do not load repositoriesTimo Teras1-2/+5
they are not needed, and cause errors if signing keys are not present.
2009-08-06audit: fix --backupTimo Teras1-1/+4
2009-08-05io: flag for following symlinks on fstatTimo Teras1-2/+2
usually we are interested on the actual file's length. but audit is interested about the link. so add a flag for this and use it in audit.
2009-07-31audit: sanitize --systemTimo Teras1-32/+79
make the system audit compare only installed files, instead of scanning the whole file system. also make it print only package names with -q, so reinstalling modified packages becomes easy.
2009-07-31apk: use *at instead of chdir+normal file syscallTimo Teras1-3/+4
this way we never change cwd, and relative filenames are always parsed consistently. this also helps filename construction in many places. this patch also changes '--root' to override location of all configuration to be in the new root. previously it depended on the file which one was used.
2009-07-30db: fix checksum storing to dbTimo Teras1-4/+3
also take precautions in audit code if the db is missing the checksum.
2009-07-30audit: protection mask for "symlinks only"Timo Teras1-0/+5
and use it for /etc/init.d by default. fixes #99.
2009-07-22audit: add --system optionTimo Teras1-15/+21
to check system files for changes.
2009-07-14db: live with sha1 and md5Timo Teras1-3/+5
this also convers scripts file to a tar archive.
2009-07-14db: speed up fdb creationTimo Teras1-4/+3
avoid recalculating hashes, and store the lengths of names, so we can optimize some operations.
2009-07-13io: move csumming away from bstream to gunzipTimo Teras1-13/+5
in future we want to checksum on gzip boundary basis, not the full file.
2009-06-25help: auto construct helpTimo Teras1-4/+6
And add some more verbosity to the help message.
2009-05-06change apk audit letters to correspond to old sfic/lbu lettersNatanael Copa1-2/+2
A = "added" U = "updated"
2009-01-17db: database locking and creation to part of opening itTimo Teras1-1/+1
Add flags field to db open call. Also make error reporting quite a bit more detailed.
2009-01-16info: only show package desc when --verboseNatanael Copa1-1/+1
also introduce apk_verbosity. --quiet reduce verbosity and --verbose increases it. Default verbosity is 1.
2009-01-14audit: new command to check changed filesTimo Teras1-0/+146
Currently only implement --backup to get list of (config) files in protected directories to backup. This also fixes a database corruption bug in database.c.