Skip to content

fix: harden dual-boot mount options and report directory permissions #32

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jankesec wants to merge 2 commits into
base: master
Choose a base branch
from
Open

fix: harden dual-boot mount options and report directory permissions #32

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9cae243
fix: enforce secure mount options (nosuid,nodev,noexec) and restrict …
byjanke Sep 4, 2026
10a980d
fix: write system reports under /run instead of /tmp
byjanke Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 18 additions & 8 deletions src/util/DualBootManager.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,33 +51,43 @@ def get_windows_version():

def get_dualboot_oses():
dualboot = {}
os.makedirs("/run/winroot", exist_ok=True)
winroot_dir = "/run/winroot"
if os.path.islink(winroot_dir):
os.unlink(winroot_dir)
os.makedirs(winroot_dir, mode=0o700, exist_ok=True)
try:
os.chmod(winroot_dir, 0o700)
except OSError:
pass
root_part = get_root_part()
for part in list_parts():
if f"/dev/{part}" == root_part:
continue
sp = subprocess.run(
["mount", "-o", "defaults,ro", f"/dev/{part}", "/run/winroot"],
["mount", "-o", "ro,nosuid,nodev,noexec", f"/dev/{part}", winroot_dir],
capture_output=True,
)
if 0 == sp.returncode:
# Windows
if os.path.exists("/run/winroot/Windows/System32/ntoskrnl.exe"):
if os.path.exists(f"{winroot_dir}/Windows/System32/ntoskrnl.exe"):
dualboot[part] = "Windows " + get_windows_version()
# Mac OS X
if os.path.exists(
"/run/winroot/System/Library/CoreServices/SystemVersion.plist"
f"{winroot_dir}/System/Library/CoreServices/SystemVersion.plist"
):
dualboot[part] = "Mac OS X"
# Linux
if os.path.exists("/run/winroot/etc/os-release"):
with open("/run/winroot/etc/os-release", "r") as f:
if os.path.exists(f"{winroot_dir}/etc/os-release"):
with open(f"{winroot_dir}/etc/os-release", "r") as f:
for line in f.read().split("\n"):
if line.startswith("NAME="):
dualboot[part] = line[6:-1]
os.system("umount -lf /run/winroot")
subprocess.run(["umount", "-lf", winroot_dir], check=False)

os.rmdir("/run/winroot")
try:
os.rmdir(winroot_dir)
except OSError:
pass
return json.dumps(dualboot)


Expand Down
26 changes: 18 additions & 8 deletions src/util/SystemReportManager.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@

from util import ComputerManager

ARCHIVE_DIR = "/tmp/pardus_system_report"
ARCHIVE_DIR = "/run/pardus-about-report"


def detect_pkexec_user():
Expand All @@ -24,7 +24,7 @@ def detect_pkexec_user():


def run_and_save(command, command_name=None):
"""Usage: run_and_save(["journalctl", "-q", "-n", 1000]), it will be saved in /tmp/pardus_system_report/journalctl"""
"""Usage: run_and_save(["journalctl", "-q", "-n", 1000]), it will be saved under ARCHIVE_DIR."""

if not command:
return
Expand Down Expand Up @@ -64,8 +64,13 @@ def generate_report():
os.unlink(ARCHIVE_DIR)
elif os.path.isdir(ARCHIVE_DIR):
shutil.rmtree(ARCHIVE_DIR)
# Make dir
os.makedirs(f"{ARCHIVE_DIR}/{pkexec_user}", exist_ok=True)
# Make dir with secure 0700 permissions
os.makedirs(f"{ARCHIVE_DIR}/{pkexec_user}", mode=0o700, exist_ok=True)
try:
os.chmod(ARCHIVE_DIR, 0o700)
os.chmod(f"{ARCHIVE_DIR}/{pkexec_user}", 0o700)
except OSError:
pass

# Program outputs
run_and_save(
Expand Down Expand Up @@ -125,9 +130,9 @@ def generate_report():
copy("/etc/apt/sources.list")
copy("/etc/apt/sources.list.d")

# set permission and owner
# set permission and owner (0700: strictly restricted to pkexec_user)
subprocess.run(["chown", pkexec_user, "-R", ARCHIVE_DIR])
subprocess.run(["chmod", "755", "-R", ARCHIVE_DIR])
subprocess.run(["chmod", "700", "-R", ARCHIVE_DIR])


def generate_user_report():
Expand All @@ -136,8 +141,13 @@ def generate_user_report():
ComputerManager.ComputerManager().get_all_device_info(), indent=2
)

# Make dir
os.makedirs(f"{ARCHIVE_DIR}/{pkexec_user}", exist_ok=True)
# Make dir with secure 0700 permissions
os.makedirs(f"{ARCHIVE_DIR}/{pkexec_user}", mode=0o700, exist_ok=True)
try:
os.chmod(ARCHIVE_DIR, 0o700)
os.chmod(f"{ARCHIVE_DIR}/{pkexec_user}", 0o700)
except OSError:
pass

with open(f"{ARCHIVE_DIR}/{pkexec_user}/system_info.json", "w") as f:
f.write(hardware_info)
Expand Down