Skip to content

Commit 873ef88

Browse files
authored
fix: 99.1.3_acc_sudoers_no_all: fix a race condition (#186)
On systems where /etc/sudoers.d might be updated often by some automated means, this check might raise a critical when a previously present file (during the ls) is no longer present (during its attempted read), so before raising a critical, re-check that it does exists first.
1 parent bd27cd0 commit 873ef88

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

bin/hardening/99.1.3_acc_sudoers_no_all.sh

+7-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,13 @@ audit() {
6060
fi
6161
for file in $FILES; do
6262
if $SUDO_CMD [ ! -r "$file" ]; then
63-
crit "$file is not readable"
63+
debug "$file is not readable, but it might just have disappeared since we've listed the folder contents, re-check that it exists"
64+
if $SUDO_CMD [ -e "$file" ]; then
65+
crit "$file is not readable"
66+
else
67+
debug "$file has disappeared, ignore it"
68+
continue
69+
fi
6470
else
6571
if ! $SUDO_CMD grep -E "$REGEX" "$file" &>/dev/null; then
6672
if [ $skiplog = 0 ]; then

0 commit comments

Comments
 (0)