Codebase list stealth / upstream/2.11.03
Imported Upstream version 2.11.03 tony mancill 10 years ago
8 changed file(s) with 19 addition(s) and 12 deletion(s). Raw diff Collapse all Expand all
+1
-1
VERSION less more
0 #define VERSION "2.11.02"
0 #define VERSION "2.11.03"
11 #define YEARS "2005-2013"
+7
-0
changelog less more
0 stealth (2.11.03)
1
2 * In Stealth's man-page and manual -perm -xxxx was replaced by -perm /xxxx,
3 as per the POSIX standard.
4
5 -- Frank B. Brokken <f.b.brokken@rug.nl> Sat, 15 Jun 2013 14:34:42 +0200
6
07 stealth (2.11.02)
18
29 * Stealth returns 0 for options --help and --version
+3
-3
documentation/man/stealth.yo less more
575575
576576 tt(CHECK LOG = remote/ls.root \)nl()
577577 tt( /usr/bin/find / \)nl()
578 tt( -xdev -perm +6111 -type f -exec /bin/ls -l {} \;)
578 tt( -xdev -perm /6111 -type f -exec /bin/ls -l {} \;)
579579
580580 All suid/gid/executable files on the same device as the root-directory (/)
581581 on the client computer are listed with their permissions, owner and size
585585
586586 tt(CHECK remote/sha1.root \)nl()
587587 tt( /usr/bin/find / \)nl()
588 tt( -xdev -perm +6111 -type f -exec /usr/bin/sha1sum {} \;)
588 tt( -xdev -perm /6111 -type f -exec /usr/bin/sha1sum {} \;)
589589
590590 The SHA1 checksums of all suid/gid/executable files on the same device as
591591 the root-directory (/) on the client computer are determined. The resulting
601601 Example:nl()
602602 tt(NOTEST CHECK LOG = remote/sha1.root \)nl()
603603 tt( /usr/bin/find / \)nl()
604 tt( -xdev -perm +6111 -type f -exec /usr/bin/sha1sum {} \;)
604 tt( -xdev -perm /6111 -type f -exec /usr/bin/sha1sum {} \;)
605605
606606
607607 The SHA1 checksums of all suid/gid/executable files on the same device as
+3
-3
documentation/manual/policy/commands.yo less more
290290 COMMENT(CAREFUL: EXTRA BLANK REQUIRD IN THE YODL FILE BEHIND \ )
291291 verb(
292292 CHECK LOG = remote/ls.root /usr/bin/find / \
293 -xdev -perm +6111 -type f -exec /bin/ls -l {} \;
293 -xdev -perm /6111 -type f -exec /bin/ls -l {} \;
294294 )
295295 All suid/gid/executable files on the same device as the root-directory (/)
296296 on the client computer are listed with their permissions, owner and size
299299
300300 This long command could be formulated shorter using a tt(DEFINE):
301301 verb(
302 DEFINE LSFIND -xdev -perm +6111 -type f -exec /bin/ls -l {} \;
302 DEFINE LSFIND -xdev -perm /6111 -type f -exec /bin/ls -l {} \;
303303 CHECK remote/ls.root /usr/bin/find / ${LSFIND}
304304 )
305305
306306 Another example:
307307 verb(
308 DEFINE SHA1SUM -xdev -perm +6111 -type f -exec /usr/bin/sha1sum {} \;
308 DEFINE SHA1SUM -xdev -perm /6111 -type f -exec /usr/bin/sha1sum {} \;
309309 CHECK remote/sha1.root /usr/bin/find / ${SHA1SUM}
310310 )
311311 The SHA1 checksums of all suid/gid/executable files on the same device as
+1
-1
documentation/manual/policy/defines.yo less more
2828 Example:
2929 verb(
3030 DEFINE SSH /usr/bin/ssh frankbash@localhost -q
31 DEFINE EXECSHA1 -xdev -perm +111 -type f -exec /usr/bin/sha1sum {} \;
31 DEFINE EXECSHA1 -xdev -perm /111 -type f -exec /usr/bin/sha1sum {} \;
3232 )
3333 The symbols defined by tt(DEFINE) directives may consist of
3434 letters, digits and the underscore character (tt(_)).
+2
-2
documentation/manual/running/firstrun.yo less more
2121 -exec /usr/bin/sha1sum {} \;
2222 LABEL \nconfiguration files under /etc
2323 CHECK LOG = remote/etcfiles /usr/bin/find /etc
24 -type f -not -perm +6111 -not -regex "/etc/\(adjtime\|mtab\)"
24 -type f -not -perm /6111 -not -regex "/etc/\(adjtime\|mtab\)"
2525 -exec /usr/bin/sha1sum {} \;
2626 LOCAL /usr/bin/scp -q root@client:/usr/bin/sha1sum /root/tmp
2727 LABEL \nCheck the client's sha1sum program
3434 -exec /usr/bin/sha1sum {} \;
3535 LABEL \nconfiguration files under /etc
3636 CHECK LOG = remote/etcfiles /usr/bin/find /etc
37 -type f -not -perm +6111 -not -regex "/etc/\(adjtime\|mtab\)"
37 -type f -not -perm /6111 -not -regex "/etc/\(adjtime\|mtab\)"
3838 -exec /usr/bin/sha1sum {} \;
3939 )
4040
+1
-1
documentation/manual/running/makepolicy.yo less more
141141 verb(
142142 LABEL \nconfiguration files under /etc
143143 CHECK LOG = remote/etcfiles \
144 /usr/bin/find /etc -type f -not -perm +6111 \
144 /usr/bin/find /etc -type f -not -perm /6111 \
145145 -not -regex "/etc/\(adjtime\|mtab\)" \
146146 -exec /usr/bin/sha1sum {} \;
147147 )
+1
-1
documentation/manual/running/policy.demo less more
2626
2727 LABEL \nconfiguration files under /etc
2828 CHECK LOG = remote/etcfiles \
29 /usr/bin/find /etc -type f -not -perm +6111 \
29 /usr/bin/find /etc -type f -not -perm /6111 \
3030 -not -regex "/etc/\(adjtime\|mtab\)" \
3131 -exec /usr/bin/sha1sum {} \;
3232