64 lines
2.6 KiB
Bash
64 lines
2.6 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
# Debian maintainer script: postinst
|
|
# Purpose:
|
|
# - Apply statoverrides for setuid helpers (policy-compliant)
|
|
# - Ensure CEF chrome-sandbox has correct mode (if shipped)
|
|
# - Reload udev rules (best-effort)
|
|
# - Reload systemd units (best-effort, debhelper-friendly)
|
|
|
|
case "$1" in
|
|
configure|abort-upgrade|abort-deconfigure|abort-remove)
|
|
|
|
# ------------------------------------------------------------
|
|
# 1) setuid helpers via dpkg-statoverride (preferred)
|
|
# ------------------------------------------------------------
|
|
if command -v dpkg-statoverride >/dev/null 2>&1; then
|
|
if [ -e /usr/bin/bastionguard-privhelper ]; then
|
|
dpkg-statoverride --list /usr/bin/bastionguard-privhelper >/dev/null 2>&1 \
|
|
|| dpkg-statoverride --add root root 4755 /usr/bin/bastionguard-privhelper || true
|
|
fi
|
|
|
|
if [ -e /usr/bin/bastionguard-firewall ]; then
|
|
dpkg-statoverride --list /usr/bin/bastionguard-firewall >/dev/null 2>&1 \
|
|
|| dpkg-statoverride --add root root 4755 /usr/bin/bastionguard-firewall || true
|
|
fi
|
|
fi
|
|
|
|
# ------------------------------------------------------------
|
|
# 2) CEF sandbox permissions (if installed)
|
|
# Notes:
|
|
# - chrome-sandbox typically requires setuid root (4755).
|
|
# - There's no Debian-wide statoverride convention for this file,
|
|
# so we apply chmod best-effort.
|
|
# ------------------------------------------------------------
|
|
if [ -e /usr/share/BastionGuard/cef/chrome-sandbox ]; then
|
|
chmod 4755 /usr/share/BastionGuard/cef/chrome-sandbox || true
|
|
chown root:root /usr/share/BastionGuard/cef/chrome-sandbox || true
|
|
fi
|
|
|
|
# ------------------------------------------------------------
|
|
# 3) udev reload (best-effort)
|
|
# ------------------------------------------------------------
|
|
if command -v udevadm >/dev/null 2>&1; then
|
|
udevadm control --reload-rules >/dev/null 2>&1 || true
|
|
udevadm trigger >/dev/null 2>&1 || true
|
|
fi
|
|
|
|
# ------------------------------------------------------------
|
|
# 4) systemd unit reload (debhelper-friendly)
|
|
# Prefer deb-systemd-helper / deb-systemd-invoke when available.
|
|
# ------------------------------------------------------------
|
|
if [ -d /run/systemd/system ]; then
|
|
if command -v deb-systemd-helper >/dev/null 2>&1; then
|
|
# This is safe even if units are not enabled here.
|
|
deb-systemd-helper daemon-reload >/dev/null 2>&1 || true
|
|
elif command -v systemctl >/dev/null 2>&1; then
|
|
systemctl daemon-reload >/dev/null 2>&1 || true
|
|
fi
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
exit 0
|