mustard/ansible-playbooks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wip: tweaking remove suid script

Browse source
This commit is contained in:
mustard 2025-09-17 02:26:03 +02:00
parent 02635c146b
commit abf2dd653d
1 changed files with 21 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

21
remove_suid.sh
View file

@ -17,7 +17,28 @@ set -oue pipefail
# Reference: https://gist.github.com/ok-ryoko/1ff42a805d496cb1ca22e5cdf6ddefb0#usrbinchage
whitelist=(
# Need to allowlist qrexec binaries to ensure qubes templates (hopefully) don't break, not sure why they're duplicated in /usr/bin and /usr/sbin
"/usr/bin/qfile-unpacker"
"/usr/sbin/qfile-unpacker"
"/usr/bin/qrexec-client-vm"
"/usr/sbin/qrexec-client-vm"
"/usr/bin/qrexec-fork-server"
"/usr/sbin/qrexec-fork-server"
"/usr/bin/qrexec-legacy-convert"
"/usr/sbin/qrexec-legacy-convert"
"/usr/bin/qrexec-policy"
"/usr/sbin/qrexec-policy"
"/usr/bin/qrexec-policy-agent"
"/usr/sbin/qrexec-policy-agent"
"/usr/bin/qrexec-policy-daemon"
"/usr/sbin/qrexec-policy-daemon"
"/usr/bin/qrexec-policy-exec"
"/usr/sbin/qrexec-policy-exec"
"/usr/bin/qrexec-policy-graph"
"/usr/sbin/qrexec-policy-graph"
"/usr/bin/qrexec-policy-restore"
"/usr/sbin/qrexec-policy-restore"
# Required for nvidia closed driver images
"/usr/bin/nvidia-modprobe"
# https://gitlab.freedesktop.org/polkit/polkit/-/issues/168