From 3e3d7453e3318ac79ea36ae14ed90442ded0c165 Mon Sep 17 00:00:00 2001 From: "claude (dev371 3fff1819-b77d-4dde-be19-8c01e09d3394)" Date: Fri, 28 Aug 2026 01:23:45 -0400 Subject: [PATCH 1/3] lintian: drop redundant maintainer-script-ignores-errors override Now suppressed globally in genmkfile; the false positive is the same errexit long-form case. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../overrides/security-misc-shared#security-misc-shared | 4 ---- 1 file changed, 4 deletions(-) diff --git a/usr/share/lintian/overrides/security-misc-shared#security-misc-shared b/usr/share/lintian/overrides/security-misc-shared#security-misc-shared index dc9c90a0..1dad42d7 100644 --- a/usr/share/lintian/overrides/security-misc-shared#security-misc-shared +++ b/usr/share/lintian/overrides/security-misc-shared#security-misc-shared @@ -21,7 +21,3 @@ security-misc-shared: systemd-service-file-missing-install-key [usr/lib/systemd/ ## Minor bug: Unknown. security-misc-shared: package-contains-empty-directory [usr/share/security-misc-shared/] - -## The postinst enables errexit via long-form 'set -o errexit'; lintian's -## scripts check only matches short 'set -e'. False-positive (like tb-updater). -security-misc-shared: maintainer-script-ignores-errors [postinst] From 24b39b0ca1b6c5a0fd35036703f56a2a1f5b9225 Mon Sep 17 00:00:00 2001 From: "claude (dev474 c7439536-fad8-4884-b71a-d2f3c4c23905)" Date: Mon, 7 Sep 2026 11:49:54 -0400 Subject: [PATCH 2/3] rename has.sh to has.bsh (bashism convention) Sourced helper-scripts lib uses bashisms; .bsh marks it. Scoped to has.sh consumers (repo carries unrelated concurrent WIP). --- debian/security-misc-shared.postinst | 2 +- usr/bin/remount-secure#security-misc-shared | 2 +- .../check-for-usb-controller#security-misc-shared | 4 ++-- .../security-misc/lkrg/lkrg-virtualbox#security-misc-shared | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/debian/security-misc-shared.postinst b/debian/security-misc-shared.postinst index 1d304e2d..995d2f70 100755 --- a/debian/security-misc-shared.postinst +++ b/debian/security-misc-shared.postinst @@ -4,7 +4,7 @@ ## See the file COPYING for copying conditions. ## style-ok: allow-echo (Debian maintainer-script convention) -## style-ok: no-has (has.sh not reliably available this early in maintainer scripts) +## style-ok: no-has (has.bsh not reliably available this early in maintainer scripts) ## style-ok: no-strict (debconf maintainer script; full strict block would leak into APT/debconf) if [ -f /usr/libexec/helper-scripts/pre.bsh ]; then diff --git a/usr/bin/remount-secure#security-misc-shared b/usr/bin/remount-secure#security-misc-shared index 55c2924e..87dee021 100755 --- a/usr/bin/remount-secure#security-misc-shared +++ b/usr/bin/remount-secure#security-misc-shared @@ -26,7 +26,7 @@ ## https://www.kicksecure.com/wiki/Dev/remount-secure ## https://forums.whonix.org/t/re-mount-home-and-other-with-noexec-and-nosuid-among-other-useful-mount-options-for-better-security/7707 -## style-ok: no-has (runs in dracut where helper-scripts has.sh is unavailable; id itself may be absent) +## style-ok: no-has (runs in dracut where helper-scripts has.bsh is unavailable; id itself may be absent) ## Mount helper functions (_boot, _sys, _usr, ...) are invoked indirectly via ## the dispatch in main(); shellcheck cannot see the calls. diff --git a/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared b/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared index 6ba31508..efb7641d 100755 --- a/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared +++ b/usr/libexec/security-misc/check-for-usb-controller#security-misc-shared @@ -12,8 +12,8 @@ shopt -s shift_verbose export LC_ALL=C ## security-misc-shared Depends on helper-scripts. -# shellcheck source=../../../../helper-scripts/usr/libexec/helper-scripts/has.sh -source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.sh +# shellcheck source=../../../../helper-scripts/usr/libexec/helper-scripts/has.bsh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.bsh ## Package 'pciutils' provides tool 'lspci'. has lspci diff --git a/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared b/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared index fb18eb61..86b9a6fa 100755 --- a/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared +++ b/usr/share/security-misc/lkrg/lkrg-virtualbox#security-misc-shared @@ -13,8 +13,8 @@ shopt -s shift_verbose export LC_ALL=C ## security-misc-shared Depends on helper-scripts. -# shellcheck source=../../../../helper-scripts/usr/libexec/helper-scripts/has.sh -source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.sh +# shellcheck source=../../../../helper-scripts/usr/libexec/helper-scripts/has.bsh +source "${HELPER_SCRIPTS_PATH:-}"/usr/libexec/helper-scripts/has.bsh ## Check if the VirtualBox host software is installed. if ! has vboxmanage ; then From dd05179ea3310d0cac4d2de9db220ebbd5224fbf Mon Sep 17 00:00:00 2001 From: Aaron Rainbolt Date: Tue, 8 Sep 2026 21:24:00 -0400 Subject: [PATCH 3/3] fix --- .../permission-hardener#security-misc-shared | 24 ++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/usr/bin/permission-hardener#security-misc-shared b/usr/bin/permission-hardener#security-misc-shared index 6d061dfd..1cc80184 100755 --- a/usr/bin/permission-hardener#security-misc-shared +++ b/usr/bin/permission-hardener#security-misc-shared @@ -472,20 +472,21 @@ load_state() { processed_config_line="${line}" ## We can handle filenames with spaces. This is because the first item - ## after a filename is an octal file mode, and we only support user/group - ## names, not UIDs and GIDs, as owner identifiers. This means that we can - ## scan from right to left for the furthest-right octal integer field and - ## use it to separate the filename from the rest of the options. (If - ## usernames could themselves be octal integers, this would break, but - ## adduser.conf's default NAME_REGEX forbids this. This is definitely a - ## hack, but the alternative is to change the format of the policy files, - ## which would break custom config for users. + ## after a filename is either an octal file mode or a keyword, and we + ## only support user/group names, not UIDs and GIDs, as owner + ## identifiers. This means that we can scan from right to left for the + ## furthest-right octal integer rr keyword field and use it to separate + ## the filename from the rest of the options. (If usernames could + ## themselves be octal integers, this would break, but adduser.conf's + ## default NAME_REGEX forbids this. This is definitely a hack, but the + ## alternative is to change the format of the policy files, which would + ## break custom config for users. ## ## 'read' will collapse consecutive spaces when splitting on spaces. ## Convert spaces into newlines first, then split on newlines with a ## loop. field_list=() - while read IFS= -r one_field; do + while IFS= read -r one_field; do field_list+=( "${one_field}" ) done < <(printf '%s\n' "${line}" | tr ' ' '\n') field_count="${#field_list[@]}" @@ -493,10 +494,11 @@ load_state() { hit_barrier='false' fso_name="" meta_list=() - for (( field_index = field_count - 1; field_index <= 0; \ + for (( field_index = field_count - 1; field_index >= 0; \ field_index-- )); do if [ "${hit_barrier}" = 'false' ]; then - if [[ "${field_list[field_index]}" =~ ^[0-7]{3,4}$ ]]; then + if [[ "${field_list[field_index]}" =~ ^[0-7]{3,4}$ ]] \ + || [[ "${field_list[field_index]}" =~ ^(nosuid|exactwhitelist|matchwhitelist|disablewhitelist)$ ]]; then hit_barrier='true' fi meta_list=( "${field_list[field_index]}" "${meta_list[@]}" )