From f680493dd88b896b16de6898fd6193f6acfe84f1 Mon Sep 17 00:00:00 2001 From: mhoellein Date: Tue, 7 Jul 2020 11:32:41 +0200 Subject: [PATCH] committing changes in /etc made by "/usr/bin/python3 /tmp/ubuntu-release-upgrader-6eheyq_2/focal --mode=server --frontend=DistUpgradeViewText --devel-release" Package changes: -accountsservice 0.6.45-1ubuntu1 amd64 -acl 2.2.52-3build1 amd64 -acpid 1:2.0.28-1ubuntu1 amd64 +accountsservice 0.6.55-0ubuntu12~20.04.1 amd64 +acl 2.2.53-6 amd64 +acpid 1:2.0.32-1ubuntu1 amd64 -adduser 3.116ubuntu1 all -aide 0.16-3 amd64 -aide-common 0.16-3 all +adduser 3.118ubuntu2 all +aide 0.16.1-1build2 amd64 +aide-common 0.16.1-1build2 all +alsa-topology-conf 1.2.2-1 all +alsa-ucm-conf 1.2.2-1ubuntu0.1 all -amavisd-new 1:2.11.0-1ubuntu1.1 all -amd64-microcode 3.20191021.1+really3.20181128.1~ubuntu0.18.04.1 amd64 -apache2 2.4.43-1+ubuntu18.04.1+deb.sury.org+7 amd64 -apache2-bin 2.4.43-1+ubuntu18.04.1+deb.sury.org+7 amd64 -apache2-data 2.4.43-1+ubuntu18.04.1+deb.sury.org+7 all -apache2-utils 2.4.43-1+ubuntu18.04.1+deb.sury.org+7 amd64 -apparmor 2.12-4ubuntu5.1 amd64 -apt 1.6.12ubuntu0.1 amd64 -apt-show-versions 0.22.7ubuntu1 all -apt-transport-https 1.6.12ubuntu0.1 all -apt-utils 1.6.12ubuntu0.1 amd64 -augeas-lenses 1.10.1-2 all -base-files 10.1ubuntu2.8 amd64 -base-passwd 3.5.44 amd64 -bash 4.4.18-2ubuntu1.2 amd64 -bash-completion 1:2.8-1ubuntu1 all -bind9 1:9.11.3+dfsg-1ubuntu1.12 amd64 -bind9-host 1:9.11.3+dfsg-1ubuntu1.12 amd64 -bind9utils 1:9.11.3+dfsg-1ubuntu1.12 amd64 -binutils 2.30-21ubuntu1~18.04.3 amd64 -binutils-common 2.30-21ubuntu1~18.04.3 amd64 -binutils-x86-64-linux-gnu 2.30-21ubuntu1~18.04.3 amd64 -borgbackup 1.1.5-1 amd64 -bsdmainutils 11.1.2ubuntu1 amd64 -bsdutils 1:2.31.1-0.4ubuntu3.6 amd64 -busybox-initramfs 1:1.27.2-2ubuntu3.2 amd64 -busybox-static 1:1.27.2-2ubuntu3.2 amd64 -bzip2 1.0.6-8.1ubuntu0.2 amd64 -ca-certificates 20190110~18.04.1 all -certbot 0.27.0-1~ubuntu18.04.1 all +amavisd-new 1:2.11.0-6.1ubuntu1 all +amd64-microcode 3.20191218.1ubuntu1 amd64 +apache2 2.4.43-1+ubuntu20.04.1+deb.sury.org+7 amd64 +apache2-bin 2.4.43-1+ubuntu20.04.1+deb.sury.org+7 amd64 +apache2-data 2.4.43-1+ubuntu20.04.1+deb.sury.org+7 all +apache2-utils 2.4.43-1+ubuntu20.04.1+deb.sury.org+7 amd64 +apparmor 2.13.3-7ubuntu5.1 amd64 +apt 2.0.2ubuntu0.1 amd64 +apt-show-versions 0.22.11 all +apt-transport-https 2.0.2ubuntu0.1 all +apt-utils 2.0.2ubuntu0.1 amd64 +augeas-lenses 1.12.0-1build1 all +base-files 11ubuntu5 amd64 +base-passwd 3.5.47 amd64 +bash 5.0-6ubuntu1 amd64 +bash-completion 1:2.10-1ubuntu1 all +bind9 1:9.16.1-0ubuntu2.2 amd64 +bind9-dnsutils 1:9.16.1-0ubuntu2.2 amd64 +bind9-host 1:9.16.1-0ubuntu2.2 amd64 +bind9-libs 1:9.16.1-0ubuntu2.2 amd64 +bind9-utils 1:9.16.1-0ubuntu2.2 amd64 +bind9utils 1:9.16.1-0ubuntu2.2 all +binutils 2.34-6ubuntu1 amd64 +binutils-common 2.34-6ubuntu1 amd64 +binutils-x86-64-linux-gnu 2.34-6ubuntu1 amd64 +borgbackup 1.1.11-5 amd64 +bsdmainutils 11.1.2ubuntu3 amd64 +bsdutils 1:2.34-0.1ubuntu9 amd64 +busybox-initramfs 1:1.30.1-4ubuntu6.1 amd64 +busybox-static 1:1.30.1-4ubuntu6.1 amd64 +bzip2 1.0.8-2 amd64 +ca-certificates 20190110ubuntu1.1 all +certbot 0.40.0-1 all -command-not-found 18.04.5 all +command-not-found 20.04.2 all -console-setup 1.178ubuntu2.9 all -console-setup-linux 1.178ubuntu2.9 all -coreutils 8.28-1ubuntu1 amd64 -cpio 2.12+dfsg-6ubuntu0.18.04.1 amd64 -cpp 4:7.4.0-1ubuntu2.3 amd64 -cpp-7 7.5.0-3ubuntu1~18.04 amd64 +console-setup 1.194ubuntu3 all +console-setup-linux 1.194ubuntu3 all +coreutils 8.30-3ubuntu2 amd64 +cpio 2.13+dfsg-2 amd64 +cpp 4:9.3.0-1ubuntu2 amd64 +cpp-7 7.5.0-6ubuntu2 amd64 +cpp-9 9.3.0-10ubuntu2 amd64 -cron 3.0pl1-128.1ubuntu1 amd64 -curl 7.58.0-2ubuntu3.9 amd64 -dash 0.5.8-2.10 amd64 -dbconfig-common 2.0.9 all -dbconfig-mysql 2.0.9 all -dbus 1.12.2-1ubuntu1.2 amd64 -debconf 1.5.66ubuntu1 all -debconf-i18n 1.5.66ubuntu1 all -debianutils 4.8.4 amd64 -dictionaries-common 1.27.2 all -diffutils 1:3.6-1 amd64 -dirmngr 2.2.4-1ubuntu1.2 amd64 -distro-info-data 0.37ubuntu0.7 all -dmidecode 3.1-1ubuntu0.1 amd64 -dmsetup 2:1.02.145-4.1ubuntu3.18.04.3 amd64 -dns-root-data 2018013001 all -dnsutils 1:9.11.3+dfsg-1ubuntu1.12 amd64 -dosfstools 4.1-1 amd64 -dovecot-antispam 2.0+20170109-1build2 amd64 -dovecot-core 1:2.2.33.2-1ubuntu4.5 amd64 -dovecot-imapd 1:2.2.33.2-1ubuntu4.5 amd64 -dovecot-lmtpd 1:2.2.33.2-1ubuntu4.5 amd64 -dovecot-managesieved 1:2.2.33.2-1ubuntu4.5 amd64 -dovecot-mysql 1:2.2.33.2-1ubuntu4.5 amd64 -dovecot-sieve 1:2.2.33.2-1ubuntu4.5 amd64 -dpkg 1.19.0.5ubuntu2.3 amd64 -e2fsprogs 1.44.1-1ubuntu1.3 amd64 -ed 1.10-2.1 amd64 -eject 2.1.5+deb1+cvs20081104-13.2 amd64 -emacsen-common 2.0.8 all -etckeeper 1.18.5-1ubuntu1 all -expat 2.2.5-3ubuntu0.2 amd64 -expect 5.45.4-1 amd64 -fail2ban 0.10.2-2 all -fdisk 2.31.1-0.4ubuntu3.6 amd64 -file 1:5.32-2ubuntu0.4 amd64 -findutils 4.6.0+git+20170828-2 amd64 -fontconfig 2.12.6-0ubuntu2 amd64 -fontconfig-config 2.12.6-0ubuntu2 all +cron 3.0pl1-136ubuntu1 amd64 +curl 7.68.0-1ubuntu2.1 amd64 +dash 0.5.10.2-6 amd64 +dbconfig-common 2.0.13 all +dbconfig-mysql 2.0.13 all +dbus 1.12.16-2ubuntu2.1 amd64 +debconf 1.5.73 all +debconf-i18n 1.5.73 all +debianutils 4.9.1 amd64 +dictionaries-common 1.28.1 all +diffutils 1:3.7-3 amd64 +dirmngr 2.2.19-3ubuntu2 amd64 +distro-info-data 0.43ubuntu1.1 all +dmidecode 3.2-3 amd64 +dmsetup 2:1.02.167-1ubuntu1 amd64 +dns-root-data 2019052802 all +dnsutils 1:9.16.1-0ubuntu2.2 all +dosfstools 4.1-2 amd64 +dovecot-antispam 2.0+20171229-1build5 amd64 +dovecot-core 1:2.3.7.2-1ubuntu3.1 amd64 +dovecot-imapd 1:2.3.7.2-1ubuntu3.1 amd64 +dovecot-lmtpd 1:2.3.7.2-1ubuntu3.1 amd64 +dovecot-managesieved 1:2.3.7.2-1ubuntu3.1 amd64 +dovecot-mysql 1:2.3.7.2-1ubuntu3.1 amd64 +dovecot-sieve 1:2.3.7.2-1ubuntu3.1 amd64 +dpkg 1.19.7ubuntu3 amd64 +e2fsprogs 1.45.5-2ubuntu1 amd64 +ed 1.16-1 amd64 +eject 2.1.5+deb1+cvs20081104-14 amd64 +emacsen-common 3.0.4 all +etckeeper 1.18.12-1.1ubuntu1 all +expat 2.2.9-1build1 amd64 +expect 5.45.4-2build1 amd64 +fail2ban 0.11.1-1 all +fdisk 2.34-0.1ubuntu9 amd64 +file 1:5.38-4 amd64 +findutils 4.7.0-1ubuntu1 amd64 +fontconfig 2.13.1-2ubuntu3 amd64 +fontconfig-config 2.13.1-2ubuntu3 all -friendly-recovery 0.2.38ubuntu1.1 all -ftp 0.17-34 amd64 -fuse 2.9.7-1ubuntu1 amd64 -gcc 4:7.4.0-1ubuntu2.3 amd64 +friendly-recovery 0.2.41 all +ftp 0.17-34.1 amd64 +fuse 2.9.9-3 amd64 +gcc 4:9.3.0-1ubuntu2 amd64 -gcc-7 7.5.0-3ubuntu1~18.04 amd64 -gcc-7-base 7.5.0-3ubuntu1~18.04 amd64 -gcc-8-base 8.4.0-1ubuntu1~18.04 amd64 -geoip-database 20180315-1 all -gettext-base 0.19.8.1-6ubuntu0.3 amd64 -gir1.2-glib-2.0 1.56.1-1 amd64 -git 1:2.17.1-1ubuntu0.7 amd64 -git-man 1:2.17.1-1ubuntu0.7 all -gnupg 2.2.4-1ubuntu1.2 amd64 -gnupg-l10n 2.2.4-1ubuntu1.2 all -gnupg-utils 2.2.4-1ubuntu1.2 amd64 -gpg 2.2.4-1ubuntu1.2 amd64 -gpg-agent 2.2.4-1ubuntu1.2 amd64 -gpg-wks-client 2.2.4-1ubuntu1.2 amd64 -gpg-wks-server 2.2.4-1ubuntu1.2 amd64 -gpgconf 2.2.4-1ubuntu1.2 amd64 -gpgsm 2.2.4-1ubuntu1.2 amd64 -gpgv 2.2.4-1ubuntu1.2 amd64 -grep 3.1-2build1 amd64 -groff-base 1.22.3-10 amd64 -grub-common 2.02-2ubuntu8.15 amd64 +gcc-7 7.5.0-6ubuntu2 amd64 +gcc-7-base 7.5.0-6ubuntu2 amd64 +gcc-8-base 8.4.0-3ubuntu2 amd64 +gcc-9 9.3.0-10ubuntu2 amd64 +gcc-9-base 9.3.0-10ubuntu2 amd64 +geoip-database 20191224-2 all +gettext-base 0.19.8.1-10build1 amd64 +gir1.2-glib-2.0 1.64.1-1~ubuntu20.04.1 amd64 +git 1:2.25.1-1ubuntu3 amd64 +git-man 1:2.25.1-1ubuntu3 all +gnupg 2.2.19-3ubuntu2 all +gnupg-l10n 2.2.19-3ubuntu2 all +gnupg-utils 2.2.19-3ubuntu2 amd64 +gpg 2.2.19-3ubuntu2 amd64 +gpg-agent 2.2.19-3ubuntu2 amd64 +gpg-wks-client 2.2.19-3ubuntu2 amd64 +gpg-wks-server 2.2.19-3ubuntu2 amd64 +gpgconf 2.2.19-3ubuntu2 amd64 +gpgsm 2.2.19-3ubuntu2 amd64 +gpgv 2.2.19-3ubuntu2 amd64 +grep 3.4-1 amd64 +groff-base 1.22.4-4build1 amd64 +grub-common 2.04-1ubuntu26 amd64 -grub-pc 2.02-2ubuntu8.15 amd64 -grub-pc-bin 2.02-2ubuntu8.15 amd64 -grub2-common 2.02-2ubuntu8.15 amd64 -guile-2.0-libs 2.0.13+1-5ubuntu0.1 amd64 -gzip 1.6-5ubuntu1 amd64 -hdparm 9.54+ds-1 amd64 -hostname 3.20 amd64 -info 6.5.0.dfsg.1-2 amd64 -init 1.51 amd64 -init-system-helpers 1.51 all -initramfs-tools 0.130ubuntu3.9 all -initramfs-tools-bin 0.130ubuntu3.9 amd64 -initramfs-tools-core 0.130ubuntu3.9 all -install-info 6.5.0.dfsg.1-2 amd64 +grub-pc 2.04-1ubuntu26 amd64 +grub-pc-bin 2.04-1ubuntu26 amd64 +grub2-common 2.04-1ubuntu26 amd64 +guile-2.0-libs 2.0.13+1-5.4 amd64 +guile-2.2-libs 2.2.7+1-4 amd64 +gzip 1.10-0ubuntu4 amd64 +hdparm 9.58+ds-4 amd64 +hostname 3.23 amd64 +icc-profiles-free 2.0.1+dfsg-1 all +info 6.7.0.dfsg.2-5 amd64 +init 1.57 amd64 +init-system-helpers 1.57 all +initramfs-tools 0.136ubuntu6.2 all +initramfs-tools-bin 0.136ubuntu6.2 amd64 +initramfs-tools-core 0.136ubuntu6.2 all +install-info 6.7.0.dfsg.2-5 amd64 -intel-microcode 3.20200609.0ubuntu0.18.04.1 amd64 -iotop 0.6-2 amd64 -iproute2 4.15.0-2ubuntu1.1 amd64 -ipset 6.34-1 amd64 -iptables 1.6.1-2ubuntu2 amd64 -iputils-ping 3:20161105-1ubuntu3 amd64 -iputils-tracepath 3:20161105-1ubuntu3 amd64 -irqbalance 1.3.0-0.1ubuntu0.18.04.1 amd64 -isc-dhcp-client 4.3.5-3ubuntu7.1 amd64 -isc-dhcp-common 4.3.5-3ubuntu7.1 amd64 -iso-codes 3.79-1 all +intel-microcode 3.20200609.0ubuntu0.20.04.2 amd64 +iotop 0.6-24-g733f3f8-1 amd64 +iproute2 5.5.0-1ubuntu1 amd64 +ipset 7.5-1~exp1 amd64 +iptables 1.8.4-3ubuntu2 amd64 +iputils-ping 3:20190709-3 amd64 +iputils-tracepath 3:20190709-3 amd64 +irqbalance 1.6.0-3ubuntu1 amd64 +isc-dhcp-client 4.4.1-2.1ubuntu5 amd64 +isc-dhcp-common 4.4.1-2.1ubuntu5 amd64 +iso-codes 4.4-1 all -iw 4.14-0.1 amd64 +iw 5.4-1 amd64 -kbd 2.0.4-2ubuntu1 amd64 -keyboard-configuration 1.178ubuntu2.9 all -klibc-utils 2.0.4-9ubuntu2 amd64 -kmod 24-1ubuntu3.4 amd64 -knockd 0.7-1ubuntu1.18.04.2 amd64 -krb5-locales 1.16-2ubuntu0.1 all -language-pack-en 1:18.04+20190718 all -language-pack-en-base 1:18.04+20180712 all -language-pack-gnome-en 1:18.04+20190718 all -language-pack-gnome-en-base 1:18.04+20180712 all -language-selector-common 0.188.3 all +kbd 2.0.4-4ubuntu2 amd64 +keyboard-configuration 1.194ubuntu3 all +klibc-utils 2.0.7-1ubuntu5 amd64 +kmod 27-1ubuntu2 amd64 +knockd 0.7-1ubuntu3 amd64 +krb5-locales 1.17-6ubuntu4 all +language-pack-en 1:20.04+20200416 all +language-pack-en-base 1:20.04+20200416 all +language-pack-gnome-en 1:20.04+20200416 all +language-pack-gnome-en-base 1:20.04+20200416 all +language-selector-common 0.204 all -less 487-0.1 amd64 +less 551-1 amd64 -libaccountsservice0 0.6.45-1ubuntu1 amd64 -libacl1 2.2.52-3build1 amd64 -libaio1 0.3.110-5ubuntu0.1 amd64 +libaccountsservice0 0.6.55-0ubuntu12~20.04.1 amd64 +libacl1 2.2.53-6 amd64 +libaio1 0.3.112-5 amd64 -libapparmor1 2.12-4ubuntu5.1 amd64 -libapr1 1.6.3-2 amd64 +libapache2-mod-php7.4 7.4.3-4ubuntu2.2 amd64 +libapparmor1 2.13.3-7ubuntu5.1 amd64 +libapr1 1.6.5-1+ubuntu20.04.1+deb.sury.org+1 amd64 -libapt-inst2.0 1.6.12ubuntu0.1 amd64 -libapt-pkg-perl 0.1.33build1 amd64 -libapt-pkg5.0 1.6.12ubuntu0.1 amd64 -libarchive-zip-perl 1.60-1ubuntu0.1 all -libargon2-0 0~20161029-1.1 amd64 -libasan4 7.5.0-3ubuntu1~18.04 amd64 -libasn1-8-heimdal 7.5.0+dfsg-1 amd64 -libassuan0 2.5.1-2 amd64 -libatm1 1:2.5.1-2build1 amd64 -libatomic1 8.4.0-1ubuntu1~18.04 amd64 -libattr1 1:2.4.47-2build1 amd64 -libaudit-common 1:2.8.2-1ubuntu1 all -libaudit1 1:2.8.2-1ubuntu1 amd64 -libaugeas0 1.10.1-2 amd64 -libauthen-pam-perl 0.16-3build5 amd64 +libapt-pkg-perl 0.1.36build3 amd64 +libapt-pkg6.0 2.0.2ubuntu0.1 amd64 +libarchive-zip-perl 1.67-2 all +libargon2-0 0~20171227-0.2 amd64 +libargon2-1 0~20171227-0.2 amd64 +libasan4 7.5.0-6ubuntu2 amd64 +libasan5 9.3.0-10ubuntu2 amd64 +libasn1-8-heimdal 7.7.0+dfsg-1ubuntu1 amd64 +libasound2 1.2.2-2.1ubuntu1 amd64 +libasound2-data 1.2.2-2.1ubuntu1 all +libassuan0 2.5.3-7ubuntu2 amd64 +libatm1 1:2.5.1-4 amd64 +libatomic1 10-20200411-0ubuntu1 amd64 +libattr1 1:2.4.48-5 amd64 +libaudit-common 1:2.8.5-2ubuntu6 all +libaudit1 1:2.8.5-2ubuntu6 amd64 +libaugeas0 1.12.0-1build1 amd64 +libauthen-pam-perl 0.16-3build7 amd64 -libb2-1 0.97+git20171226-2 amd64 -libberkeleydb-perl 0.55-1build4 amd64 +libb2-1 0.98.1-1.1 amd64 +libberkeleydb-perl 0.62-1build1 amd64 -libbinutils 2.30-21ubuntu1~18.04.3 amd64 -libblkid1 2.31.1-0.4ubuntu3.6 amd64 -libbrotli1 1.0.7-2+ubuntu18.04.1+deb.sury.org+1 amd64 -libbsd0 0.8.7-1ubuntu0.1 amd64 -libbz2-1.0 1.0.6-8.1ubuntu0.2 amd64 +libbinutils 2.34-6ubuntu1 amd64 +libblkid1 2.34-0.1ubuntu9 amd64 +libbrotli1 1.0.7-6build1 amd64 +libbsd0 0.10.0-1 amd64 +libbz2-1.0 1.0.8-2 amd64 -libcap-ng0 0.7.7-3.1 amd64 -libcap2 1:2.25-1.2 amd64 -libcap2-bin 1:2.25-1.2 amd64 -libcc1-0 8.4.0-1ubuntu1~18.04 amd64 -libcgi-fast-perl 1:2.13-1 all -libcgi-pm-perl 4.38-1 all -libcharon-standard-plugins 5.6.2-1ubuntu2.5 amd64 -libcilkrts5 7.5.0-3ubuntu1~18.04 amd64 -libcom-err2 1.44.1-1ubuntu1.3 amd64 +libcanberra0 0.30-7ubuntu1 amd64 +libcap-ng0 0.7.9-2.1build1 amd64 +libcap2 1:2.32-1 amd64 +libcap2-bin 1:2.32-1 amd64 +libcbor0.6 0.6.0-0ubuntu1 amd64 +libcc1-0 10-20200411-0ubuntu1 amd64 +libcgi-fast-perl 1:2.15-1 all +libcgi-pm-perl 4.46-1 all +libcharon-extauth-plugins 5.8.2-1ubuntu3.1 amd64 +libcharon-standard-plugins 5.8.2-1ubuntu3.1 all +libcilkrts5 7.5.0-6ubuntu2 amd64 +libcom-err2 1.45.5-2ubuntu1 amd64 +libcommon-sense-perl 3.74-2build6 amd64 -libconvert-uulib-perl 1:1.5~dfsg-1 amd64 +libconvert-uulib-perl 1:1.5~dfsg-1build2 amd64 -libcrypt-openssl-bignum-perl 0.09-1build1 amd64 -libcrypt-openssl-rsa-perl 0.28-5build2 amd64 +libcrypt-openssl-bignum-perl 0.09-1build3 amd64 +libcrypt-openssl-random-perl 0.15-1build2 amd64 +libcrypt-openssl-rsa-perl 0.31-1build1 amd64 -libcryptsetup12 2:2.0.2-1ubuntu1.1 amd64 -libcurl3-gnutls 7.58.0-2ubuntu3.9 amd64 -libcurl4 7.58.0-2ubuntu3.9 amd64 -libdb5.3 5.3.28-13.1ubuntu1.1 amd64 -libdbd-mysql-perl 4.046-1 amd64 -libdbi-perl 1.640-1 amd64 -libdbus-1-3 1.12.2-1ubuntu1.2 amd64 -libdebconfclient0 0.213ubuntu1 amd64 -libdevmapper1.02.1 2:1.02.145-4.1ubuntu3.18.04.3 amd64 -libdigest-hmac-perl 1.03+dfsg-1 all +libcryptsetup12 2:2.2.2-3ubuntu2 amd64 +libctf-nobfd0 2.34-6ubuntu1 amd64 +libctf0 2.34-6ubuntu1 amd64 +libcurl3-gnutls 7.68.0-1ubuntu2.1 amd64 +libcurl4 7.68.0-1ubuntu2.1 amd64 +libdb5.3 5.3.28+dfsg1-0.6ubuntu2 amd64 +libdbd-mysql-perl 4.050-3 amd64 +libdbi-perl 1.643-1 amd64 +libdbus-1-3 1.12.16-2ubuntu2.1 amd64 +libdebconfclient0 0.251ubuntu1 amd64 +libdevmapper1.02.1 2:1.02.167-1ubuntu1 amd64 +libdigest-bubblebabble-perl 0.02-2 all +libdigest-hmac-perl 1.03+dfsg-2 all +libdns-export1109 1:9.11.16+dfsg-3~build1 amd64 -libdrm-amdgpu1 2.4.101-2~18.04.1 amd64 -libdrm-common 2.4.101-2~18.04.1 all -libdrm-intel1 2.4.101-2~18.04.1 amd64 -libdrm-nouveau2 2.4.101-2~18.04.1 amd64 -libdrm-radeon1 2.4.101-2~18.04.1 amd64 -libdrm2 2.4.101-2~18.04.1 amd64 -libedit2 3.1-20170329-1 amd64 -libelf1 0.170-0.4ubuntu0.1 amd64 +libdrm-amdgpu1 2.4.101-2 amd64 +libdrm-common 2.4.101-2 all +libdrm-intel1 2.4.101-2 amd64 +libdrm-nouveau2 2.4.101-2 amd64 +libdrm-radeon1 2.4.101-2 amd64 +libdrm2 2.4.101-2 amd64 +libedit2 3.1-20191231-1 amd64 +libefiboot1 37-2ubuntu2 amd64 +libefivar1 37-2ubuntu2 amd64 +libelf1 0.176-1.1build1 amd64 -liberror-perl 0.17025-1 all +liberror-perl 0.17029-1 all +libevent-2.1-7 2.1.11-stable-1 amd64 -libexpat1 2.2.5-3ubuntu0.2 amd64 -libext2fs2 1.44.1-1ubuntu1.3 amd64 +libevent-core-2.1-7 2.1.11-stable-1 amd64 +libexpat1 2.2.9-1build1 amd64 +libext2fs2 1.45.5-2ubuntu1 amd64 -libfcgi-perl 0.78-2build1 amd64 -libfdisk1 2.31.1-0.4ubuntu3.6 amd64 +libfcgi-perl 0.79-1 amd64 +libfdisk1 2.34-0.1ubuntu9 amd64 -libfontconfig1 2.12.6-0ubuntu2 amd64 -libfreetype6 2.8.1-2ubuntu2 amd64 -libfribidi0 0.19.7-2 amd64 -libfuse2 2.9.7-1ubuntu1 amd64 -libgc1c2 1:7.4.2-8ubuntu1 amd64 -libgcc-7-dev 7.5.0-3ubuntu1~18.04 amd64 +libffi7 3.3-4 amd64 +libfido2-1 1.3.1-1ubuntu2 amd64 +libfontconfig1 2.13.1-2ubuntu3 amd64 +libfreetype6 2.10.1-2 amd64 +libfribidi0 1.0.8-2 amd64 +libfuse2 2.9.9-3 amd64 +libgc1c2 1:7.6.4-0.4ubuntu1 amd64 +libgcc-7-dev 7.5.0-6ubuntu2 amd64 +libgcc-9-dev 9.3.0-10ubuntu2 amd64 -libgcc1 1:8.4.0-1ubuntu1~18.04 amd64 -libgcrypt20 1.8.1-4ubuntu1.2 amd64 -libgd3 2.2.5-4ubuntu0.4 amd64 -libgdbm-compat4 1.14.1-6 amd64 +libgcc1 1:10-20200411-0ubuntu1 amd64 +libgcrypt20 1.8.5-5ubuntu1 amd64 +libgd3 2.2.5-5.2ubuntu2 amd64 +libgdbm-compat4 1.18.1-5 amd64 -libgeoip1 1.6.12-1 amd64 -libgirepository-1.0-1 1.56.1-1 amd64 -libgl1-mesa-dri 19.2.8-0ubuntu0~18.04.3 amd64 -libglapi-mesa 19.2.8-0ubuntu0~18.04.3 amd64 -libglib2.0-0 2.56.4-0ubuntu0.18.04.6 amd64 -libglib2.0-data 2.56.4-0ubuntu0.18.04.6 all -libgmp10 2:6.1.2+dfsg-2 amd64 -libgnutls30 3.5.18-1ubuntu1.4 amd64 -libgomp1 8.4.0-1ubuntu1~18.04 amd64 -libgpg-error0 1.27-6 amd64 -libgpgme11 1.10.0-1ubuntu2 amd64 +libgdbm6 1.18.1-5 amd64 +libgeoip1 1.6.12-6build1 amd64 +libgirepository-1.0-1 1.64.1-1~ubuntu20.04.1 amd64 +libgl1-mesa-dri 20.0.8-0ubuntu1~20.04.1 amd64 +libglapi-mesa 20.0.8-0ubuntu1~20.04.1 amd64 +libglib2.0-0 2.64.2-1~fakesync1 amd64 +libglib2.0-data 2.64.2-1~fakesync1 all +libgmp10 2:6.2.0+dfsg-4 amd64 +libgnutls30 3.6.13-2ubuntu1.2 amd64 +libgomp1 10-20200411-0ubuntu1 amd64 +libgpg-error-l10n 1.37-1 all +libgpg-error0 1.37-1 amd64 +libgpgme11 1.13.1-7ubuntu2 amd64 -libgsasl7 1.8.0-8ubuntu3 amd64 -libgssapi-krb5-2 1.16-2ubuntu0.1 amd64 -libgssapi3-heimdal 7.5.0+dfsg-1 amd64 -libhcrypto4-heimdal 7.5.0+dfsg-1 amd64 -libheimbase1-heimdal 7.5.0+dfsg-1 amd64 -libheimntlm0-heimdal 7.5.0+dfsg-1 amd64 +libgsasl7 1.8.1-1 amd64 +libgssapi-krb5-2 1.17-6ubuntu4 amd64 +libgssapi3-heimdal 7.7.0+dfsg-1ubuntu1 amd64 +libhcrypto4-heimdal 7.7.0+dfsg-1ubuntu1 amd64 +libheimbase1-heimdal 7.7.0+dfsg-1ubuntu1 amd64 +libheimntlm0-heimdal 7.7.0+dfsg-1ubuntu1 amd64 +libhiredis0.14 0.14.0-6 amd64 -libhtml-parser-perl 3.72-3build1 amd64 -libhtml-tagset-perl 3.20-3 all +libhogweed5 3.5.1+really3.5.1-2 amd64 +libhtml-parser-perl 3.72-5 amd64 +libhtml-tagset-perl 3.20-4 all -libhttp-date-perl 6.02-1 all -libhttp-message-perl 6.14-1 all -libhx509-5-heimdal 7.5.0+dfsg-1 amd64 +libhttp-date-perl 6.05-1 all +libhttp-message-perl 6.22-1 all +libhx509-5-heimdal 7.7.0+dfsg-1ubuntu1 amd64 -libidn11 1.33-2.1ubuntu1.2 amd64 +libicu66 66.1-2ubuntu2 amd64 +libidn11 1.33-2.2ubuntu2 amd64 -libio-pty-perl 1:1.08-1.1build4 amd64 +libio-pty-perl 1:1.12-1 amd64 -libio-socket-ssl-perl 2.060-3~ubuntu18.04.1 all -libio-stringy-perl 2.111-2 all +libio-socket-ssl-perl 2.067-1 all +libio-stringy-perl 2.111-3 all +libip4tc2 1.8.4-3ubuntu2 amd64 +libip6tc2 1.8.4-3ubuntu2 amd64 +libipset13 7.5-1~exp1 amd64 -libiptc0 1.6.1-2ubuntu2 amd64 +libiptc0 1.8.4-3ubuntu2 amd64 +libisc-export1105 1:9.11.16+dfsg-3~build1 amd64 -libitm1 8.4.0-1ubuntu1~18.04 amd64 -libjansson4 2.11-1 amd64 +libisl22 0.22.1-1 amd64 +libitm1 10-20200411-0ubuntu1 amd64 +libjansson4 2.12-1build1 amd64 -libjpeg-turbo8 1.5.2-0ubuntu5.18.04.4 amd64 +libjemalloc2 5.2.1-1ubuntu1 amd64 +libjpeg-turbo8 2.0.3-0ubuntu1.20.04.1 amd64 -libjs-jquery 3.2.1-1 all -libjs-sphinxdoc 1.6.7-1ubuntu1 all -libjs-underscore 1.8.3~dfsg-1 all +libjs-jquery 3.3.1~dfsg-3 all +libjs-openlayers 2.13.1+ds2-7 all +libjs-sphinxdoc 1.8.5-7ubuntu3 all +libjs-underscore 1.9.1~dfsg-1 all -libk5crypto3 1.16-2ubuntu0.1 amd64 -libkeyutils1 1.5.9-9.2ubuntu2 amd64 -libklibc 2.0.4-9ubuntu2 amd64 -libkmod2 24-1ubuntu3.4 amd64 -libkrb5-26-heimdal 7.5.0+dfsg-1 amd64 -libkrb5-3 1.16-2ubuntu0.1 amd64 -libkrb5support0 1.16-2ubuntu0.1 amd64 +libjson-c4 0.13.1+dfsg-7ubuntu0.3 amd64 +libjson-perl 4.02000-2 all +libjson-xs-perl 4.020-1build1 amd64 +libk5crypto3 1.17-6ubuntu4 amd64 +libkeyutils1 1.6-6ubuntu1 amd64 +libklibc 2.0.7-1ubuntu5 amd64 +libkmod2 27-1ubuntu2 amd64 +libkrb5-26-heimdal 7.7.0+dfsg-1ubuntu1 amd64 +libkrb5-3 1.17-6ubuntu4 amd64 +libkrb5support0 1.17-6ubuntu4 amd64 -libkyotocabinet16v5 1.2.76-4.2 amd64 -liblchown-perl 1.01-3build3 amd64 -libldap-2.4-2 2.4.45+dfsg-1ubuntu1.5 amd64 -libldap-common 2.4.45+dfsg-1ubuntu1.5 all -libllvm9 1:9-2~ubuntu18.04.2 amd64 -liblocale-gettext-perl 1.07-3build2 amd64 -liblockfile-bin 1.14-1.1 amd64 -liblockfile1 1.14-1.1 amd64 -liblsan0 8.4.0-1ubuntu1~18.04 amd64 -libltdl7 2.4.6-2 amd64 -liblua5.1-0 5.1.5-8.1build2 amd64 -liblua5.2-0 5.2.4-1.1build1 amd64 -liblwp-mediatypes-perl 6.02-1 all +libkyotocabinet16v5 1.2.76-4.2build1 amd64 +liblchown-perl 1.01-3build5 amd64 +libldap-2.4-2 2.4.49+dfsg-2ubuntu1.2 amd64 +libldap-common 2.4.49+dfsg-2ubuntu1.2 all +libllvm10 1:10.0.0-4ubuntu1 amd64 +libllvm9 1:9.0.1-12 amd64 +liblmdb0 0.9.24-1 amd64 +liblocale-gettext-perl 1.07-4 amd64 +liblockfile-bin 1.16-1.1 amd64 +liblockfile1 1.16-1.1 amd64 +liblsan0 10-20200411-0ubuntu1 amd64 +libltdl7 2.4.6-14 amd64 +liblua5.1-0 5.1.5-8.1build4 amd64 +liblua5.2-0 5.2.4-1.1build3 amd64 +liblua5.3-0 5.3.3-1.1ubuntu2 amd64 +liblwp-mediatypes-perl 6.04-1 all -liblz4-1 0.0~r131-2ubuntu3 amd64 -liblzma5 5.2.2-1.3 amd64 -liblzo2-2 2.08-1.2 amd64 -libmagic-mgc 1:5.32-2ubuntu0.4 amd64 -libmagic1 1:5.32-2ubuntu0.4 amd64 -libmail-dkim-perl 0.44-1 all +liblz4-1 1.9.2-2 amd64 +liblzma5 5.2.4-1 amd64 +liblzo2-2 2.10-2 amd64 +libmagic-mgc 1:5.38-4 amd64 +libmagic1 1:5.38-4 amd64 +libmail-authenticationresults-perl 1.20200108-1 all +libmail-dkim-perl 0.58-1 all -libmailtools-perl 2.18-1 all -libmailutils5 1:3.4-1 amd64 -libmemcached11 1.0.18-4.2ubuntu0.18.04.1 amd64 -libmilter1.0.1 8.15.2-10 amd64 +libmailtools-perl 2.21-1 all +libmailutils6 1:3.7-2.1 amd64 +libmaxminddb0 1.4.2-0ubuntu1 amd64 +libmecab2 0.996-10build1 amd64 +libmemcached11 1.0.18-4.2ubuntu2 amd64 +libmilter1.0.1 8.15.2-18 amd64 -libmount1 2.31.1-0.4ubuntu3.6 amd64 +libmount1 2.34-0.1ubuntu9 amd64 -libmpdec2 2.4.2-1ubuntu1 amd64 -libmpfr6 4.0.1-1 amd64 -libmpx2 8.4.0-1ubuntu1~18.04 amd64 +libmpdec2 2.4.2-3 amd64 +libmpfr6 4.0.2-1 amd64 +libmpx2 8.4.0-3ubuntu2 amd64 -libncurses5 6.1-1ubuntu1.18.04 amd64 -libncursesw5 6.1-1ubuntu1.18.04 amd64 -libnet-cidr-lite-perl 0.21-1 all -libnet-cidr-perl 0.18-1 all -libnet-dns-perl 1.10-2 all -libnet-ip-perl 1.26-1 all -libnet-libidn-perl 0.12.ds-2build4 amd64 -libnet-patricia-perl 1.22-1build4 amd64 -libnet-server-perl 2.009-1 all +libmysqlclient21 8.0.20-0ubuntu0.20.04.1 amd64 +libncurses5 6.2-0ubuntu2 amd64 +libncurses6 6.2-0ubuntu2 amd64 +libncursesw5 6.2-0ubuntu2 amd64 +libncursesw6 6.2-0ubuntu2 amd64 +libnet-cidr-lite-perl 0.21-2 all +libnet-cidr-perl 0.20-1 all +libnet-dns-perl 1.22-1 all +libnet-dns-sec-perl 1.15-1 amd64 +libnet-ip-perl 1.26-2 all +libnet-libidn-perl 0.12.ds-3build2 amd64 +libnet-patricia-perl 1.22-1build6 amd64 +libnet-server-perl 2.009-2 all -libnet-ssleay-perl 1.84-1ubuntu0.2 amd64 -libnet1 1.1.6+dfsg-3.1 amd64 -libnetaddr-ip-perl 4.079+dfsg-1build2 amd64 -libnetfilter-conntrack3 1.0.6-2 amd64 -libnetplan0 0.99-0ubuntu3~18.04.3 amd64 +libnet-ssleay-perl 1.88-2ubuntu1 amd64 +libnet1 1.1.6+dfsg-3.1build1 amd64 +libnetaddr-ip-perl 4.079+dfsg-1build4 amd64 +libnetfilter-conntrack3 1.0.7-2 amd64 +libnetplan0 0.99-0ubuntu3~20.04.2 amd64 -libnewt0.52 0.52.20-1ubuntu1 amd64 -libnfnetlink0 1.0.1-3 amd64 -libnghttp2-14 1.30.0-1ubuntu1 amd64 +libnettle7 3.5.1+really3.5.1-2 amd64 +libnewt0.52 0.52.21-4ubuntu2 amd64 +libnfnetlink0 1.0.1-3build1 amd64 +libnftnl11 1.1.5-1 amd64 +libnghttp2-14 1.40.0-1build1 amd64 -libnl-3-200 3.2.29-0ubuntu3 amd64 -libnl-genl-3-200 3.2.29-0ubuntu3 amd64 -libnpth0 1.5-3 amd64 -libnss-systemd 237-3ubuntu10.41 amd64 +libnl-3-200 3.4.0-1 amd64 +libnl-genl-3-200 3.4.0-1 amd64 +libnpth0 1.6-1 amd64 +libnss-systemd 245.4-4ubuntu3.1 amd64 -libntlm0 1.4-8 amd64 -libnuma1 2.0.11-2.1ubuntu0.1 amd64 -libopendbx1 1.4.6-11 amd64 -libopendbx1-mysql 1.4.6-11 amd64 -libopendbx1-sqlite3 1.4.6-11 amd64 -libopendkim11 2.11.0~alpha-11build1 amd64 -libopendmarc2 1.3.2-3 amd64 -libp11-kit0 0.23.9-2 amd64 -libpam-cap 1:2.25-1.2 amd64 -libpam-modules 1.1.8-3.6ubuntu2.18.04.1 amd64 -libpam-modules-bin 1.1.8-3.6ubuntu2.18.04.1 amd64 -libpam-runtime 1.1.8-3.6ubuntu2.18.04.1 all -libpam-systemd 237-3ubuntu10.41 amd64 -libpam0g 1.1.8-3.6ubuntu2.18.04.1 amd64 -libparted2 3.2-20ubuntu0.2 amd64 -libpcap0.8 1.8.1-6ubuntu1.18.04.1 amd64 -libpci3 1:3.5.2-1ubuntu1.1 amd64 -libpciaccess0 0.14-1 amd64 -libpcre3 2:8.39-9 amd64 +libntfs-3g883 1:2017.3.23AR.3-3ubuntu1 amd64 +libntlm0 1.5-2 amd64 +libnuma1 2.0.12-1 amd64 +libogg0 1.3.4-0ubuntu1 amd64 +libonig5 6.9.4-1 amd64 +libopendbx1 1.4.6-13build4 amd64 +libopendbx1-mysql 1.4.6-13build4 amd64 +libopendbx1-sqlite3 1.4.6-13build4 amd64 +libopendkim11 2.11.0~beta2-1 amd64 +libopendmarc2 1.3.2-7 amd64 +libp11-kit0 0.23.20-1build1 amd64 +libpam-cap 1:2.32-1 amd64 +libpam-modules 1.3.1-5ubuntu4 amd64 +libpam-modules-bin 1.3.1-5ubuntu4 amd64 +libpam-runtime 1.3.1-5ubuntu4 all +libpam-systemd 245.4-4ubuntu3.1 amd64 +libpam0g 1.3.1-5ubuntu4 amd64 +libparted2 3.3-4 amd64 +libpcap0.8 1.9.1-3 amd64 +libpci3 1:3.6.4-1 amd64 +libpciaccess0 0.16-0ubuntu1 amd64 +libpcre2-8-0 10.34-7 amd64 +libpcre3 2:8.39-12build1 amd64 +libperl4-corelibs-perl 0.004-2 all -libpipeline1 1.5.0-1 amd64 +libperl5.30 5.30.0-9build1 amd64 +libpipeline1 1.5.2-2build1 amd64 -libpng16-16 1.6.34-1ubuntu0.18.04.2 amd64 -libpolkit-gobject-1-0 0.105-20ubuntu0.18.04.5 amd64 -libpopt0 1.16-11 amd64 +libplymouth5 0.9.4git20200323-0ubuntu6 amd64 +libpng16-16 1.6.37-2 amd64 +libpolkit-gobject-1-0 0.105-26ubuntu1 amd64 +libpopt0 1.16-14 amd64 -libpsl5 0.19.1-5build1 amd64 -libpython-stdlib 2.7.15~rc1-1 amd64 -libpython2.7 2.7.17-1~18.04ubuntu1 amd64 -libpython2.7-minimal 2.7.17-1~18.04ubuntu1 amd64 -libpython2.7-stdlib 2.7.17-1~18.04ubuntu1 amd64 -libpython3-stdlib 3.6.7-1~18.04 amd64 +libprocps8 2:3.3.16-1ubuntu2 amd64 +libpsl5 0.21.0-1ubuntu1 amd64 +libpython2-stdlib 2.7.17-2ubuntu4 amd64 +libpython2.7 2.7.18~rc1-2 amd64 +libpython2.7-minimal 2.7.18~rc1-2 amd64 +libpython2.7-stdlib 2.7.18~rc1-2 amd64 +libpython3-stdlib 3.8.2-0ubuntu2 amd64 -libquadmath0 8.4.0-1ubuntu1~18.04 amd64 -librbl1 2.11.0~alpha-11build1 amd64 +libpython3.8 3.8.2-1ubuntu1.1 amd64 +libpython3.8-minimal 3.8.2-1ubuntu1.1 amd64 +libpython3.8-stdlib 3.8.2-1ubuntu1.1 amd64 +libquadmath0 10-20200411-0ubuntu1 amd64 +librbl1 2.11.0~beta2-1 amd64 -libroken18-heimdal 7.5.0+dfsg-1 amd64 -librtmp1 2.4+20151223.gitfa8646d.1-1 amd64 -libsasl2-2 2.1.27~101-g0780600+dfsg-3ubuntu2.1 amd64 -libsasl2-modules 2.1.27~101-g0780600+dfsg-3ubuntu2.1 amd64 -libsasl2-modules-db 2.1.27~101-g0780600+dfsg-3ubuntu2.1 amd64 -libseccomp2 2.4.3-1ubuntu3.18.04.2 amd64 -libselinux1 2.7-2build2 amd64 -libsemanage-common 2.7-2build2 all -libsemanage1 2.7-2build2 amd64 +libreadline8 8.0-4 amd64 +libroken18-heimdal 7.7.0+dfsg-1ubuntu1 amd64 +librtmp1 2.4+20151223.gitfa8646d.1-2build1 amd64 +libsasl2-2 2.1.27+dfsg-2 amd64 +libsasl2-modules 2.1.27+dfsg-2 amd64 +libsasl2-modules-db 2.1.27+dfsg-2 amd64 +libseccomp2 2.4.3-1ubuntu3.20.04.2 amd64 +libselinux1 3.0-1build2 amd64 +libsemanage-common 3.0-1build2 all +libsemanage1 3.0-1build2 amd64 +libsensors-config 1:3.6.0-2ubuntu1 all -libsepol1 2.7-1 amd64 -libslang2 2.3.1a-3ubuntu1 amd64 +libsensors5 1:3.6.0-2ubuntu1 amd64 +libsepol1 3.0-1 amd64 +libslang2 2.3.2-4 amd64 -libsmartcols1 2.31.1-0.4ubuntu3.6 amd64 -libsocket6-perl 0.27-1build2 amd64 -libsodium23 1.0.16-2 amd64 -libspf2-2 1.2.10-7build2 amd64 -libsqlite3-0 3.22.0-1ubuntu0.4 amd64 -libss2 1.44.1-1ubuntu1.3 amd64 +libsmartcols1 2.34-0.1ubuntu9 amd64 +libsocket6-perl 0.29-1build1 amd64 +libsodium23 1.0.18-1 amd64 +libspf2-2 1.2.10-7build4 amd64 +libsqlite3-0 3.31.1-4ubuntu0.1 amd64 +libss2 1.45.5-2ubuntu1 amd64 +libssh-4 0.9.3-2ubuntu2 amd64 -libssl1.1 1.1.1g-1+ubuntu18.04.1+deb.sury.org+1 amd64 -libstdc++6 8.4.0-1ubuntu1~18.04 amd64 -libstrongswan 5.6.2-1ubuntu2.5 amd64 -libstrongswan-standard-plugins 5.6.2-1ubuntu2.5 amd64 +libssl1.1 1.1.1g-1+ubuntu20.04.1+deb.sury.org+1 amd64 +libstdc++6 10-20200411-0ubuntu1 amd64 +libstemmer0d 0+svn585-2 amd64 +libstrongswan 5.8.2-1ubuntu3.1 amd64 +libstrongswan-standard-plugins 5.8.2-1ubuntu3.1 amd64 -libsystemd0 237-3ubuntu10.41 amd64 -libtasn1-6 4.13-2 amd64 -libtcl8.6 8.6.8+dfsg-3 amd64 -libtext-charwidth-perl 0.04-7.1 amd64 -libtext-iconv-perl 1.7-5build6 amd64 -libtext-wrapi18n-perl 0.06-7.1 all -libtiff5 4.0.9-5ubuntu0.3 amd64 -libtimedate-perl 2.3000-2 all -libtinfo5 6.1-1ubuntu1.18.04 amd64 -libtokyocabinet9 1.4.48-11 amd64 -libtsan0 8.4.0-1ubuntu1~18.04 amd64 -libubsan0 7.5.0-3ubuntu1~18.04 amd64 -libudev1 237-3ubuntu10.41 amd64 +libsystemd0 245.4-4ubuntu3.1 amd64 +libtasn1-6 4.16.0-2 amd64 +libtcl8.6 8.6.10+dfsg-1 amd64 +libtdb1 1.4.2-3build1 amd64 +libtext-charwidth-perl 0.04-10 amd64 +libtext-iconv-perl 1.7-7 amd64 +libtext-wrapi18n-perl 0.06-9 all +libtiff5 4.1.0+git191117-2build1 amd64 +libtimedate-perl 2.3200-1 all +libtinfo5 6.2-0ubuntu2 amd64 +libtinfo6 6.2-0ubuntu2 amd64 +libtokyocabinet9 1.4.48-12 amd64 +libtsan0 10-20200411-0ubuntu1 amd64 +libtypes-serialiser-perl 1.0-1 all +libubsan0 7.5.0-6ubuntu2 amd64 +libubsan1 10-20200411-0ubuntu1 amd64 +libuchardet0 0.0.6-3build1 amd64 +libudev1 245.4-4ubuntu3.1 amd64 -libunistring2 0.9.9-0ubuntu2 amd64 -libunix-syslog-perl 1.1-2build9 amd64 -libunwind8 1.2.1-8 amd64 -liburi-perl 1.73-1 all -libusb-1.0-0 2:1.0.21-2 amd64 -libutempter0 1.1.6-3 amd64 -libuuid1 2.31.1-0.4ubuntu3.6 amd64 -libvbr2 2.11.0~alpha-11build1 amd64 +libunbound8 1.9.4-2ubuntu1.1 amd64 +libunistring2 0.9.10-2 amd64 +libunix-syslog-perl 1.1-3build2 amd64 +libunwind8 1.2.1-9build1 amd64 +liburi-perl 1.76-2 all +libusb-1.0-0 2:1.0.23-2build1 amd64 +libutempter0 1.1.6-4 amd64 +libuuid1 2.34-0.1ubuntu9 amd64 +libuv1 1.34.2-1ubuntu1 amd64 +libvbr2 2.11.0~beta2-1 amd64 +libvorbis0a 1.3.6-2ubuntu1 amd64 +libvorbisfile3 1.3.6-2ubuntu1 amd64 +libvulkan1 1.2.131.2-1 amd64 +libwayland-client0 1.18.0-1 amd64 -libwind0-heimdal 7.5.0+dfsg-1 amd64 -libwrap0 7.6.q-27 amd64 -libx11-6 2:1.6.4-3ubuntu0.2 amd64 -libx11-data 2:1.6.4-3ubuntu0.2 all -libxau6 1:1.0.8-1ubuntu1 amd64 -libxcb1 1.13-2~ubuntu18.04 amd64 -libxdmcp6 1:1.1.2-3 amd64 -libxext6 2:1.3.3-1 amd64 +libwind0-heimdal 7.7.0+dfsg-1ubuntu1 amd64 +libwrap0 7.6.q-30 amd64 +libx11-6 2:1.6.9-2ubuntu1 amd64 +libx11-data 2:1.6.9-2ubuntu1 all +libx11-xcb1 2:1.6.9-2ubuntu1 amd64 +libxau6 1:1.0.9-0ubuntu1 amd64 +libxcb-dri3-0 1.14-2 amd64 +libxcb-present0 1.14-2 amd64 +libxcb-randr0 1.14-2 amd64 +libxcb-sync1 1.14-2 amd64 +libxcb1 1.14-2 amd64 +libxdmcp6 1:1.1.3-0ubuntu1 amd64 +libxext6 2:1.3.4-0ubuntu1 amd64 -libxml2 2.9.4+dfsg1-6.1ubuntu1.3 amd64 -libxmuu1 2:1.1.2-2 amd64 +libxml2 2.9.10+dfsg-5 amd64 +libxmuu1 2:1.1.3-0ubuntu1 amd64 -libxslt1.1 1.1.29-5ubuntu0.2 amd64 -libxtables12 1.6.1-2ubuntu2 amd64 +libxshmfence1 1.3-1 amd64 +libxslt1.1 1.1.34-4 amd64 +libxtables12 1.8.4-3ubuntu2 amd64 -libyaml-0-2 0.1.7-2ubuntu3 amd64 +libyaml-0-2 0.2.2-1 amd64 -libzstd1 1.3.3+dfsg-2ubuntu1.1 amd64 -linux-base 4.5ubuntu1.2 all -linux-firmware 1.173.18 all -linux-generic 4.15.0.109.97 amd64 +libzip5 1.5.1-0ubuntu1 amd64 +libzstd1 1.4.4+dfsg-3 amd64 +linux-base 4.5ubuntu3.1 all +linux-firmware 1.187.1 all +linux-generic 5.4.0.40.43 amd64 -linux-headers-generic 4.15.0.109.97 amd64 +linux-headers-5.4.0-40 5.4.0-40.44 all +linux-headers-5.4.0-40-generic 5.4.0-40.44 amd64 +linux-headers-generic 5.4.0.40.43 amd64 -linux-image-generic 4.15.0.109.97 amd64 -linux-libc-dev 4.15.0-109.110 amd64 +linux-image-5.4.0-40-generic 5.4.0-40.44 amd64 +linux-image-generic 5.4.0.40.43 amd64 +linux-libc-dev 5.4.0-40.44 amd64 +linux-modules-5.4.0-40-generic 5.4.0-40.44 amd64 +linux-modules-extra-5.4.0-40-generic 5.4.0-40.44 amd64 -login 1:4.5-1ubuntu2 amd64 -logrotate 3.11.0-0.1ubuntu1 amd64 +login 1:4.8.1-1ubuntu5.20.04 amd64 +logrotate 3.14.0-4ubuntu3 amd64 +logsave 1.45.5-2ubuntu1 amd64 -lsb-base 9.20170808ubuntu1 all -lsb-release 9.20170808ubuntu1 all -lshw 02.18-0.1ubuntu6.18.04.1 amd64 -lsof 4.89+dfsg-0.1 amd64 -ltrace 0.7.3-6ubuntu1 amd64 -mailutils 1:3.4-1 amd64 -mailutils-common 1:3.4-1 all -make 4.1-9.1ubuntu1 amd64 -man-db 2.8.3-2ubuntu0.1 amd64 -manpages 4.15-1 all +lsb-base 11.1.0ubuntu2 all +lsb-release 11.1.0ubuntu2 all +lshw 02.18.85-0.3ubuntu2 amd64 +lsof 4.93.2+dfsg-1 amd64 +ltrace 0.7.3-6.1ubuntu1 amd64 +lua-bitop 1.0.2-5 amd64 +lua-cjson 2.1.0+dfsg-2.1 amd64 +lz4 1.9.2-2 amd64 +mailutils 1:3.7-2.1 amd64 +mailutils-common 1:3.7-2.1 all +make 4.2.1-1.2 amd64 +man-db 2.9.1-1 amd64 +manpages 5.05-1 all -mawk 1.3.3-17ubuntu3 amd64 -mime-support 3.60ubuntu1 all -mlocate 0.26-2ubuntu3.1 amd64 -mount 2.31.1-0.4ubuntu3.6 amd64 -mtr-tiny 0.92-1 amd64 +mawk 1.3.4.20200120-2 amd64 +mecab-ipadic 2.7.0-20070801+main-2.1 all +mecab-ipadic-utf8 2.7.0-20070801+main-2.1 all +mecab-utils 0.996-10build1 amd64 +mesa-vulkan-drivers 20.0.8-0ubuntu1~20.04.1 amd64 +mime-support 3.64ubuntu1 all +mlocate 0.26-3ubuntu3 amd64 +mount 2.34-0.1ubuntu9 amd64 +mtr-tiny 0.93-1 amd64 -mutt 1.9.4-3ubuntu0.3 amd64 -mysql-client-5.7 5.7.30-0ubuntu0.18.04.1 amd64 -mysql-client-core-5.7 5.7.30-0ubuntu0.18.04.1 amd64 -mysql-common 5.8+1.0.4 all -mysql-server 5.7.30-0ubuntu0.18.04.1 all +mutt 1.13.2-1ubuntu0.2 amd64 +mysql-client-8.0 8.0.20-0ubuntu0.20.04.1 amd64 +mysql-client-core-8.0 8.0.20-0ubuntu0.20.04.1 amd64 +mysql-common 5.8+1.0.5ubuntu2 all +mysql-server 8.0.20-0ubuntu0.20.04.1 all -mysql-server-core-5.7 5.7.30-0ubuntu0.18.04.1 amd64 -nano 2.9.3-2 amd64 -ncurses-base 6.1-1ubuntu1.18.04 all -ncurses-bin 6.1-1ubuntu1.18.04 amd64 -ncurses-term 6.1-1ubuntu1.18.04 all -net-tools 1.60+git20161116.90da8a0-1ubuntu1 amd64 -netbase 5.4 all -netcat-openbsd 1.187-1ubuntu0.1 amd64 -netplan.io 0.99-0ubuntu3~18.04.3 amd64 -networkd-dispatcher 1.7-0ubuntu3.3 all +mysql-server-8.0 8.0.20-0ubuntu0.20.04.1 amd64 +mysql-server-core-8.0 8.0.20-0ubuntu0.20.04.1 amd64 +nano 4.8-1ubuntu1 amd64 +ncurses-base 6.2-0ubuntu2 all +ncurses-bin 6.2-0ubuntu2 amd64 +ncurses-term 6.2-0ubuntu2 all +net-tools 1.60+git20180626.aebd88e-1ubuntu1 amd64 +netbase 6.1 all +netcat-openbsd 1.206-1ubuntu1 amd64 +netplan.io 0.99-0ubuntu3~20.04.2 amd64 +networkd-dispatcher 2.0.1-1 all -ntfs-3g 1:2017.3.23-2ubuntu0.18.04.2 amd64 -opendkim 2.11.0~alpha-11build1 amd64 -opendkim-tools 2.11.0~alpha-11build1 amd64 -opendmarc 1.3.2-3 amd64 -openssh-client 1:7.6p1-4ubuntu0.3 amd64 -openssh-server 1:7.6p1-4ubuntu0.3 amd64 -openssh-sftp-server 1:7.6p1-4ubuntu0.3 amd64 -openssl 1.1.1g-1+ubuntu18.04.1+deb.sury.org+1 amd64 -os-prober 1.74ubuntu1 amd64 -parted 3.2-20ubuntu0.2 amd64 -passwd 1:4.5-1ubuntu2 amd64 -patch 2.7.6-2ubuntu1.1 amd64 -pax 1:20171021-2 amd64 -pciutils 1:3.5.2-1ubuntu1.1 amd64 -perl 5.26.1-6ubuntu0.3 amd64 -perl-base 5.26.1-6ubuntu0.3 amd64 +ntfs-3g 1:2017.3.23AR.3-3ubuntu1 amd64 +opendkim 2.11.0~beta2-1 amd64 +opendkim-tools 2.11.0~beta2-1 amd64 +opendmarc 1.3.2-7 amd64 +openssh-client 1:8.2p1-4ubuntu0.1 amd64 +openssh-server 1:8.2p1-4ubuntu0.1 amd64 +openssh-sftp-server 1:8.2p1-4ubuntu0.1 amd64 +openssl 1.1.1g-1+ubuntu20.04.1+deb.sury.org+1 amd64 +os-prober 1.74ubuntu2 amd64 +parted 3.3-4 amd64 +passwd 1:4.8.1-1ubuntu5.20.04 amd64 +patch 2.7.6-6 amd64 +pax 1:20190825-1 amd64 +pci.ids 0.0~2020.03.20-1 all +pciutils 1:3.6.4-1 amd64 +perl 5.30.0-9build1 amd64 +perl-base 5.30.0-9build1 amd64 -perl-openssl-defaults 3build1 amd64 -php 1:7.2+60ubuntu1 all -php-bz2 1:7.2+60ubuntu1 all -php-common 1:60ubuntu1 all -php-curl 1:7.2+60ubuntu1 all -php-gd 1:7.2+60ubuntu1 all -php-igbinary 2.0.5-1build1 amd64 -php-mbstring 1:7.2+60ubuntu1 all -php-memcache 3.0.9~20160311.4991c2f-5build2 amd64 -php-mysql 1:7.2+60ubuntu1 all -php-pear 1:1.10.5+submodules+notgz-1ubuntu1.18.04.1 all +perl-modules-5.30 5.30.0-9build1 all +perl-openssl-defaults 4 amd64 +php 2:7.4+75 all +php-bz2 2:7.4+75 all +php-common 2:75 all +php-curl 2:7.4+75 all +php-gd 2:7.4+75 all +php-google-recaptcha 1.2.3-1 all +php-igbinary 3.1.2+2.0.8-1build1 amd64 +php-mbstring 2:7.4+75 all +php-memcache 3.0.9~20170802.e702b5f-4build1 amd64 +php-mysql 2:7.4+75 all +php-pear 1:1.10.9+submodules+notgz-1 all -php-phpseclib 2.0.9-1 all -php-redis 3.1.6-1build1 amd64 -php-tcpdf 6.2.13+dfsg-1ubuntu1 all -php-xml 1:7.2+60ubuntu1 all -php-zip 1:7.2+60ubuntu1 all -php7.2 7.2.24-0ubuntu0.18.04.6 all +php-phpmyadmin-motranslator 5.0.0-1 all +php-phpmyadmin-shapefile 2.1-3 all +php-phpmyadmin-sql-parser 4.6.1-2 all +php-phpseclib 2.0.23-2 all +php-psr-cache 1.0.1-2 all +php-psr-container 1.0.0-2 all +php-psr-log 1.1.2-1 all +php-redis 5.1.1+4.3.0-1 amd64 +php-symfony-cache 4.3.8+dfsg-1ubuntu1 all +php-symfony-cache-contracts 1.1.8-1 all +php-symfony-expression-language 4.3.8+dfsg-1ubuntu1 all +php-symfony-service-contracts 1.1.8-1 all +php-symfony-var-exporter 4.3.8+dfsg-1ubuntu1 all +php-tcpdf 6.3.5+dfsg1-1 all +php-twig 2.12.5-1 all +php-twig-extensions 1.5.4-1 all +php-xml 2:7.4+75 all +php-zip 2:7.4+75 all -phpmyadmin 4:4.6.6-5 all -pinentry-curses 1.1.0-1 amd64 -plymouth 0.9.3-1ubuntu7.18.04.2 amd64 -plymouth-theme-ubuntu-text 0.9.3-1ubuntu7.18.04.2 amd64 -popularity-contest 1.66ubuntu1 all -postfix 3.3.0-1ubuntu0.2 amd64 -postfix-mysql 3.3.0-1ubuntu0.2 amd64 -postfix-policyd-spf-python 2.0.2-1 all -powermgmt-base 1.33 all -procps 2:3.3.12-3ubuntu1.2 amd64 -psmisc 23.1-1ubuntu0.1 amd64 -publicsuffix 20180223.1310-1 all +php7.4 7.4.3-4ubuntu2.2 all +php7.4-bz2 7.4.3-4ubuntu2.2 amd64 +php7.4-cli 7.4.3-4ubuntu2.2 amd64 +php7.4-common 7.4.3-4ubuntu2.2 amd64 +php7.4-curl 7.4.3-4ubuntu2.2 amd64 +php7.4-gd 7.4.3-4ubuntu2.2 amd64 +php7.4-json 7.4.3-4ubuntu2.2 amd64 +php7.4-mbstring 7.4.3-4ubuntu2.2 amd64 +php7.4-mysql 7.4.3-4ubuntu2.2 amd64 +php7.4-opcache 7.4.3-4ubuntu2.2 amd64 +php7.4-phpdbg 7.4.3-4ubuntu2.2 amd64 +php7.4-readline 7.4.3-4ubuntu2.2 amd64 +php7.4-xml 7.4.3-4ubuntu2.2 amd64 +php7.4-zip 7.4.3-4ubuntu2.2 amd64 +phpmyadmin 4:4.9.5+dfsg1-2 all +pinentry-curses 1.1.0-3build1 amd64 +plymouth 0.9.4git20200323-0ubuntu6 amd64 +plymouth-theme-ubuntu-text 0.9.4git20200323-0ubuntu6 amd64 +popularity-contest 1.69ubuntu1 all +postfix 3.4.10-1ubuntu1 amd64 +postfix-mysql 3.4.10-1ubuntu1 amd64 +postfix-policyd-spf-python 2.9.2-1 all +powermgmt-base 1.36 all +procps 2:3.3.16-1ubuntu2 amd64 +psmisc 23.3-1 amd64 +publicsuffix 20200303.0012-1 all -python-apt-common 1.6.5ubuntu0.3 all +python-apt-common 2.0.0 all -python-minimal 2.7.15~rc1-1 amd64 +python-is-python2 2.7.17-4 all -python2.7 2.7.17-1~18.04ubuntu1 amd64 -python2.7-minimal 2.7.17-1~18.04ubuntu1 amd64 -python3 3.6.7-1~18.04 amd64 -python3-acme 0.31.0-2~ubuntu18.04.1 all -python3-apt 1.6.5ubuntu0.3 amd64 -python3-asn1crypto 0.24.0-1 all -python3-augeas 0.5.0-1 all -python3-authres 1.0.2-1 all -python3-certbot 0.27.0-1~ubuntu18.04.1 all -python3-certbot-apache 0.23.0-1 all -python3-certifi 2018.1.18-2 all -python3-cffi-backend 1.11.5-1 amd64 -python3-chardet 3.0.4-1 all -python3-commandnotfound 18.04.5 all -python3-configargparse 0.11.0-1 all -python3-configobj 5.0.6-2 all -python3-cryptography 2.1.4-1ubuntu1.3 amd64 -python3-dbus 1.2.6-1 amd64 -python3-distro-info 0.18ubuntu0.18.04.1 all -python3-distupgrade 1:18.04.37 all -python3-dns 3.1.1-1 all -python3-future 0.15.2-4ubuntu2 all -python3-gdbm 3.6.9-1~18.04 amd64 -python3-gi 3.26.1-2ubuntu1 amd64 -python3-idna 2.6-1 all -python3-josepy 1.1.0-1 all -python3-lib2to3 3.6.9-1~18.04 all -python3-llfuse 1.3.3+dfsg-3 amd64 -python3-minimal 3.6.7-1~18.04 amd64 -python3-mock 2.0.0-3 all -python3-msgpack 0.5.6-1 amd64 -python3-netifaces 0.10.4-0.1build4 amd64 -python3-openssl 17.5.0-1ubuntu1 all -python3-parsedatetime 2.4-2 all -python3-pbr 3.1.1-3ubuntu3 all -python3-pkg-resources 39.0.1-2 all -python3-ply 3.11-1 all -python3-pyinotify 0.9.6-1 all -python3-requests 2.18.4-2ubuntu0.1 all -python3-requests-toolbelt 0.8.0-1 all -python3-rfc3339 1.0-4 all -python3-six 1.11.0-2 all -python3-spf 2.0.12t-3 all -python3-systemd 234-1build1 amd64 -python3-tz 2018.3-2 all -python3-update-manager 1:18.04.11.13 all -python3-urllib3 1.22-1ubuntu0.18.04.1 all -python3-yaml 3.12-1build2 amd64 -python3-zope.component 4.3.0-1 all -python3-zope.event 4.2.0-1 all -python3-zope.hookable 4.0.4-4build4 amd64 -python3-zope.interface 4.3.2-1build2 amd64 +python2 2.7.17-2ubuntu4 amd64 +python2-minimal 2.7.17-2ubuntu4 amd64 +python2.7 2.7.18~rc1-2 amd64 +python2.7-minimal 2.7.18~rc1-2 amd64 +python3 3.8.2-0ubuntu2 amd64 +python3-acme 1.1.0-1 all +python3-apt 2.0.0 amd64 +python3-asn1crypto 0.24.0-1build1 all +python3-augeas 0.5.0-1.1 all +python3-authres 1.2.0-2 all +python3-certbot 0.40.0-1 all +python3-certbot-apache 0.39.0-1 all +python3-certifi 2019.11.28-1 all +python3-cffi-backend 1.14.0-1build1 amd64 +python3-chardet 3.0.4-4build1 all +python3-commandnotfound 20.04.2 all +python3-configargparse 0.13.0-2 all +python3-configobj 5.0.6-4 all +python3-cryptography 2.8-3 amd64 +python3-dbus 1.2.16-1build1 amd64 +python3-distro 1.4.0-1 all +python3-distro-info 0.23ubuntu1 all +python3-distupgrade 1:20.04.19 all +python3-distutils 3.8.2-1ubuntu1 all +python3-dns 3.2.1-1 all +python3-future 0.18.2-2 all +python3-gdbm 3.8.2-1ubuntu1 amd64 +python3-gi 3.36.0-1 amd64 +python3-icu 2.4.2-0ubuntu3 amd64 +python3-idna 2.8-1 all +python3-josepy 1.2.0-2 all +python3-lib2to3 3.8.2-1ubuntu1 all +python3-llfuse 1.3.6+dfsg-2build1 amd64 +python3-minimal 3.8.2-0ubuntu2 amd64 +python3-mock 3.0.5-1build1 all +python3-msgpack 0.6.2-1 amd64 +python3-netifaces 0.10.4-1ubuntu4 amd64 +python3-openssl 19.0.0-1build1 all +python3-parsedatetime 2.4-5 all +python3-pbr 5.4.5-0ubuntu1 all +python3-pkg-resources 45.2.0-1 all +python3-ply 3.11-3build1 all +python3-pyinotify 0.9.6-1.2ubuntu1 all +python3-requests 2.22.0-2ubuntu1 all +python3-requests-toolbelt 0.8.0-1.1 all +python3-rfc3339 1.1-2 all +python3-setuptools 45.2.0-1 all +python3-six 1.14.0-2 all +python3-spf 2.0.14-1 all +python3-spf-engine 2.9.2-1 all +python3-systemd 234-3build2 amd64 +python3-tz 2019.3-1 all +python3-update-manager 1:20.04.10.1 all +python3-urllib3 1.25.8-2 all +python3-yaml 5.3.1-1 amd64 +python3-zope.component 4.3.0-3 all +python3-zope.event 4.4-2build1 all +python3-zope.hookable 5.0.0-1build1 amd64 +python3-zope.interface 4.7.1-1 amd64 +python3.8 3.8.2-1ubuntu1.1 amd64 +python3.8-minimal 3.8.2-1ubuntu1.1 amd64 -razor 1:2.85-4.2build3 amd64 -re2c 1.0.1-1 amd64 -readline-common 7.0-3 all -redis 5:4.0.9-1ubuntu0.2 all -redis-server 5:4.0.9-1ubuntu0.2 amd64 -redis-tools 5:4.0.9-1ubuntu0.2 amd64 -rsnapshot 1.4.2-1 all -rsync 3.1.2-2.1ubuntu1.1 amd64 -rsyslog 8.32.0-1ubuntu4 amd64 -sa-compile 3.4.2-0ubuntu0.18.04.4 all -screen 4.6.2-1ubuntu1 amd64 -sed 4.4-2 amd64 -sensible-utils 0.0.12 all -shared-mime-info 1.9-2 amd64 -spamassassin 3.4.2-0ubuntu0.18.04.4 all -spamc 3.4.2-0ubuntu0.18.04.4 amd64 -ssh-import-id 5.7-0ubuntu1.1 all +razor 1:2.85-4.2build5 amd64 +re2c 1.3-1ubuntu0.1 amd64 +readline-common 8.0-4 all +redis 5:5.0.7-2 all +redis-server 5:5.0.7-2 amd64 +redis-tools 5:5.0.7-2 amd64 +rsnapshot 1.4.3-2 all +rsync 3.1.3-8 amd64 +rsyslog 8.2001.0-1ubuntu1 amd64 +sa-compile 3.4.4-1ubuntu1 all +screen 4.8.0-1 amd64 +sed 4.7-1 amd64 +sensible-utils 0.0.12+nmu1 all +shared-mime-info 1.15-1 amd64 +sound-theme-freedesktop 0.8-2ubuntu1 all +spamassassin 3.4.4-1ubuntu1 all +spamc 3.4.4-1ubuntu1 amd64 +ssh-import-id 5.10-0ubuntu1 all -strace 4.21-1ubuntu1 amd64 -strongswan 5.6.2-1ubuntu2.5 all -strongswan-charon 5.6.2-1ubuntu2.5 amd64 -strongswan-libcharon 5.6.2-1ubuntu2.5 amd64 -strongswan-starter 5.6.2-1ubuntu2.5 amd64 -sudo 1.8.21p2-3ubuntu1.2 amd64 -systemd 237-3ubuntu10.41 amd64 -systemd-sysv 237-3ubuntu10.41 amd64 -sysvinit-utils 2.88dsf-59.10ubuntu1 amd64 -tar 1.29b-2ubuntu0.1 amd64 -tasksel 3.34ubuntu11 all -tasksel-data 3.34ubuntu11 all -tcl-expect 5.45.4-1 amd64 -tcl8.6 8.6.8+dfsg-3 amd64 -tcpdump 4.9.3-0ubuntu0.18.04.1 amd64 -tcptraceroute 1.5beta7+debian-4build1 amd64 -telnet 0.17-41 amd64 +strace 5.5-3ubuntu1 amd64 +strongswan 5.8.2-1ubuntu3.1 all +strongswan-charon 5.8.2-1ubuntu3.1 amd64 +strongswan-libcharon 5.8.2-1ubuntu3.1 amd64 +strongswan-starter 5.8.2-1ubuntu3.1 amd64 +sudo 1.8.31-1ubuntu1 amd64 +systemd 245.4-4ubuntu3.1 amd64 +systemd-sysv 245.4-4ubuntu3.1 amd64 +systemd-timesyncd 245.4-4ubuntu3.1 amd64 +sysvinit-utils 2.96-2.1ubuntu1 amd64 +tar 1.30+dfsg-7 amd64 +tasksel 3.34ubuntu16 all +tasksel-data 3.34ubuntu16 all +tcl-expect 5.45.4-2build1 amd64 +tcl8.6 8.6.10+dfsg-1 amd64 +tcpdump 4.9.3-4 amd64 +tcptraceroute 1.5beta7+debian-4.1 amd64 +telnet 0.17-41.2build1 amd64 -tzdata 2020a-0ubuntu0.18.04 all -ubuntu-advantage-tools 17 all -ubuntu-keyring 2018.09.18.1~18.04.0 all -ubuntu-minimal 1.417.4 amd64 -ubuntu-release-upgrader-core 1:18.04.37 all -ubuntu-standard 1.417.4 amd64 -ucf 3.0038 all -udev 237-3ubuntu10.41 amd64 -ufw 0.36-0ubuntu0.18.04.1 all -unzip 6.0-21ubuntu1 amd64 -update-manager-core 1:18.04.11.13 all +tzdata 2020a-0ubuntu0.20.04 all +ubuntu-advantage-tools 20.3 amd64 +ubuntu-keyring 2020.02.11.2 all +ubuntu-minimal 1.450.1 amd64 +ubuntu-release-upgrader-core 1:20.04.19 all +ubuntu-standard 1.450.1 amd64 +ucf 3.0038+nmu1 all +udev 245.4-4ubuntu3.1 amd64 +ufw 0.36-6 all +unzip 6.0-25ubuntu1 amd64 +update-manager-core 1:20.04.10.1 all -usbutils 1:007-4build1 amd64 -util-linux 2.31.1-0.4ubuntu3.6 amd64 -uuid-runtime 2.31.1-0.4ubuntu3.6 amd64 -vim 2:8.0.1453-1ubuntu1.3 amd64 -vim-common 2:8.0.1453-1ubuntu1.3 all -vim-runtime 2:8.0.1453-1ubuntu1.3 all -vim-tiny 2:8.0.1453-1ubuntu1.3 amd64 -wamerican 2017.08.24-1 all -wbritish 2017.08.24-1 all +usb.ids 2020.03.19-1 all +usbutils 1:012-2 amd64 +util-linux 2.34-0.1ubuntu9 amd64 +uuid-runtime 2.34-0.1ubuntu9 amd64 +vim 2:8.1.2269-1ubuntu5 amd64 +vim-common 2:8.1.2269-1ubuntu5 all +vim-runtime 2:8.1.2269-1ubuntu5 all +vim-tiny 2:8.1.2269-1ubuntu5 amd64 +wamerican 2018.04.16-1 all +wbritish 2018.04.16-1 all -wget 1.19.4-1ubuntu2.2 amd64 -whiptail 0.52.20-1ubuntu1 amd64 -whois 5.3.0 amd64 -wireless-regdb 2018.05.09-0ubuntu1~18.04.1 all +wget 1.20.3-1ubuntu1 amd64 +whiptail 0.52.21-4ubuntu2 amd64 +whois 5.5.6 amd64 +wireless-regdb 2018.05.09-0ubuntu1 all -xauth 1:1.0.10-1 amd64 -xdg-user-dirs 0.17-1ubuntu1 amd64 -xkb-data 2.23.1-1ubuntu1.18.04.1 all -xxd 2:8.0.1453-1ubuntu1.3 amd64 -xz-utils 5.2.2-1.3 amd64 +xauth 1:1.1-0ubuntu1 amd64 +xdg-user-dirs 0.17-2ubuntu1 amd64 +xkb-data 2.29-2 all +xxd 2:8.1.2269-1ubuntu5 amd64 +xz-utils 5.2.4-1 amd64 -zlib1g 1:1.2.11.dfsg-0ubuntu2 amd64 +zlib1g 1:1.2.11.dfsg-2ubuntu1 amd64 --- .etckeeper | 156 +- Muttrc | 4 +- Muttrc.d/gpg.rc | 38 +- Muttrc.d/smime.rc | 27 +- aide/aide.conf.d/31_aide_amanda-server | 1 - aide/aide.conf.d/31_aide_boinc-client | 16 + aide/aide.conf.d/31_aide_cereal | 2 +- aide/aide.conf.d/31_aide_crack | 1 + aide/aide.conf.d/31_aide_dlocate | 2 +- aide/aide.conf.d/31_aide_gnupg | 2 +- aide/aide.conf.d/31_aide_mailman | 2 +- aide/aide.conf.d/31_aide_mlocate | 2 +- aide/aide.conf.d/31_aide_proftpd | 1 - aide/aide.conf.d/31_aide_samba | 1 - aide/aide.conf.d/31_aide_sudo | 1 - aide/aide.conf.d/31_aide_systemd_journal | 9 +- aide/aide.conf.d/31_aide_systemd_sessions | 3 +- alternatives/arptables | 1 + alternatives/arptables-restore | 1 + alternatives/arptables-save | 1 + alternatives/ebtables | 1 + alternatives/ebtables-restore | 1 + alternatives/ebtables-save | 1 + alternatives/editor.da.1.gz | 1 + alternatives/editor.de.1.gz | 1 + alternatives/ex.da.1.gz | 1 + alternatives/ex.de.1.gz | 1 + alternatives/ip6tables | 1 + alternatives/ip6tables-restore | 1 + alternatives/ip6tables-save | 1 + alternatives/iptables | 1 + alternatives/iptables-restore | 1 + alternatives/iptables-save | 1 + alternatives/mecab-dictionary | 1 + alternatives/pager | 2 +- alternatives/phar | 2 +- alternatives/phar.1.gz | 2 +- alternatives/phar.phar | 2 +- alternatives/phar.phar.1.gz | 2 +- alternatives/php | 2 +- alternatives/php.1.gz | 2 +- alternatives/phpdbg | 1 + alternatives/phpdbg.1.gz | 1 + alternatives/vi.da.1.gz | 1 + alternatives/vi.de.1.gz | 1 + alternatives/view.da.1.gz | 1 + alternatives/view.de.1.gz | 1 + amavis/conf.d/20-debian_defaults | 4 +- apache2/mods-available/php7.4.conf | 25 + apache2/mods-available/php7.4.load | 3 + apache2/mods-enabled/php7.2.conf | 1 - apache2/mods-enabled/php7.2.load | 1 - apache2/mods-enabled/php7.4.conf | 1 + apache2/mods-enabled/php7.4.load | 1 + apm/event.d/20hdparm | 82 - apparmor.d/abstractions/X | 12 +- apparmor.d/abstractions/apache2-common | 4 +- .../abstractions/apparmor_api/is_enabled | 4 +- apparmor.d/abstractions/audio | 6 + apparmor.d/abstractions/base | 20 +- apparmor.d/abstractions/dovecot-common | 2 +- apparmor.d/abstractions/dri-common | 14 + apparmor.d/abstractions/dri-enumerate | 8 + apparmor.d/abstractions/fonts | 6 +- apparmor.d/abstractions/freedesktop.org | 37 +- apparmor.d/abstractions/gnome | 9 +- apparmor.d/abstractions/ibus | 10 + apparmor.d/abstractions/kde | 13 +- apparmor.d/abstractions/kde-globals-write | 10 + apparmor.d/abstractions/kde-icon-cache-write | 7 + apparmor.d/abstractions/kde-language-write | 12 + apparmor.d/abstractions/kerberosclient | 2 + apparmor.d/abstractions/launchpad-integration | 28 - apparmor.d/abstractions/ldapclient | 3 + apparmor.d/abstractions/mdns | 1 + apparmor.d/abstractions/mesa | 17 + apparmor.d/abstractions/nameservice | 30 +- apparmor.d/abstractions/nvidia | 7 +- apparmor.d/abstractions/opencl | 9 + apparmor.d/abstractions/opencl-common | 10 + apparmor.d/abstractions/opencl-intel | 17 + apparmor.d/abstractions/opencl-mesa | 20 + apparmor.d/abstractions/opencl-nvidia | 30 + apparmor.d/abstractions/opencl-pocl | 76 + apparmor.d/abstractions/php | 3 + apparmor.d/abstractions/postfix-common | 2 + apparmor.d/abstractions/private-files | 1 + apparmor.d/abstractions/private-files-strict | 1 + apparmor.d/abstractions/python | 22 +- apparmor.d/abstractions/qt5 | 22 + .../abstractions/qt5-compose-cache-write | 8 + apparmor.d/abstractions/qt5-settings-write | 11 + .../abstractions/recent-documents-write | 10 + apparmor.d/abstractions/samba | 2 +- apparmor.d/abstractions/ssl_certs | 11 + apparmor.d/abstractions/ssl_keys | 6 + apparmor.d/abstractions/ubuntu-browsers | 4 +- .../abstractions/ubuntu-browsers.d/java | 8 +- .../abstractions/ubuntu-browsers.d/multimedia | 3 + apparmor.d/abstractions/ubuntu-email | 2 +- apparmor.d/abstractions/ubuntu-helpers | 4 +- apparmor.d/abstractions/video | 4 +- apparmor.d/abstractions/vulkan | 15 + apparmor.d/local/lsb_release | 0 apparmor.d/local/nvidia_modprobe | 0 apparmor.d/lsb_release | 50 + apparmor.d/nvidia_modprobe | 63 + apparmor.d/sbin.dhclient | 8 +- apparmor.d/tunables/global | 1 + apparmor.d/tunables/kernelvars | 11 + apparmor.d/tunables/securityfs | 2 - apparmor.d/tunables/share | 15 + apparmor.d/tunables/sys | 3 +- apparmor.d/usr.bin.man | 22 +- apparmor.d/usr.lib.ipsec.charon | 14 +- apparmor.d/usr.sbin.mysqld | 7 + apparmor.d/usr.sbin.named | 24 + apparmor.d/usr.sbin.rsyslogd | 1 + apparmor.d/usr.sbin.tcpdump | 4 +- apparmor/parser.conf | 1 - apparmor/subdomain.conf | 53 - apt/apt.conf.d/01-vendor-ubuntu | 1 + apt/apt.conf.d/01autoremove | 26 +- apt/apt.conf.d/01autoremove-kernels | 64 +- apt/apt.conf.d/20apt-show-versions | 2 +- avahi/services/phpmyadmin.service | 10 + bash_completion.d/grub | 495 ----- bind/bind.keys | 48 +- bind/named.conf.default-zones | 2 +- console-setup/Uni2-Fixed16.psf.gz | Bin 4147 -> 4151 bytes console-setup/cached_UTF-8_del.kmap.gz | Bin 4024 -> 4028 bytes console-setup/cached_Uni2-Fixed16.psf.gz | Bin 4147 -> 4151 bytes console-setup/cached_setup_font.sh | 4 +- console-setup/cached_setup_keyboard.sh | 2 +- cron.d/certbot | 6 + cron.d/e2scrub_all | 2 + cron.daily/aide | 1023 +++++---- cron.daily/dpkg | 8 +- cron.daily/logrotate | 24 +- cron.daily/man-db | 7 +- cron.daily/mlocate | 2 +- cron.daily/passwd | 9 - cron.daily/popularity-contest | 44 +- cron.daily/spamassassin | 8 +- cron.daily/ubuntu-advantage-tools | 12 - cron.weekly/man-db | 5 + crontab | 9 +- dbconfig-common/opendmarc.conf | 87 + debian_version | 2 +- default/amavisd-snmp-subagent | 4 - default/dovecot | 3 - default/grub.d/init-select.cfg | 7 + default/named | 6 + default/opendkim | 6 +- default/opendmarc | 2 +- default/rsyslog | 4 - default/spamassassin | 9 +- default/ufw | 9 +- default/useradd | 2 +- e2scrub.conf | 25 + emacs/site-start.d/00debian-vars.el | 57 - emacs/site-start.d/50dictionaries-common.el | 5 +- emacs/site-start.el | 8 - etckeeper/commit.d/50vcs-commit | 18 +- etckeeper/commit.d/99push | 2 +- etckeeper/init.d/40vcs-init | 9 +- etckeeper/list-installed.d/50list-installed | 2 + etckeeper/post-install.d/50vcs-commit | 19 +- etckeeper/pre-commit.d/20warn-problem-files | 2 +- etckeeper/pre-commit.d/30store-metadata | 105 +- etckeeper/update-ignore.d/01update-ignore | 4 + ethertypes | 45 + fail2ban/action.d/abuseipdb.conf | 14 +- fail2ban/action.d/badips.py | 116 +- fail2ban/action.d/blocklist_de.conf | 10 +- fail2ban/action.d/bsd-ipfw.conf | 8 +- fail2ban/action.d/cloudflare.conf | 4 +- fail2ban/action.d/complain.conf | 4 +- fail2ban/action.d/dshield.conf | 4 +- fail2ban/action.d/dummy.conf | 4 +- fail2ban/action.d/firewallcmd-ipset.conf | 10 +- fail2ban/action.d/helpers-common.conf | 33 +- fail2ban/action.d/hostsdeny.conf | 14 +- fail2ban/action.d/ipfilter.conf | 4 +- fail2ban/action.d/ipfw.conf | 4 +- fail2ban/action.d/iptables-allports.conf | 4 +- fail2ban/action.d/iptables-ipset-proto4.conf | 4 +- .../iptables-ipset-proto6-allports.conf | 16 +- fail2ban/action.d/iptables-ipset-proto6.conf | 16 +- fail2ban/action.d/iptables-multiport-log.conf | 4 +- fail2ban/action.d/iptables-multiport.conf | 4 +- fail2ban/action.d/iptables-new.conf | 4 +- .../action.d/iptables-xt_recent-echo.conf | 4 +- fail2ban/action.d/iptables.conf | 4 +- fail2ban/action.d/mail-buffered.conf | 4 +- fail2ban/action.d/mail-whois-common.conf | 2 +- fail2ban/action.d/mail-whois-lines.conf | 4 +- fail2ban/action.d/mail-whois.conf | 4 +- fail2ban/action.d/mail.conf | 4 +- fail2ban/action.d/mynetwatchman.conf | 4 +- fail2ban/action.d/nftables-allports.conf | 11 +- fail2ban/action.d/nftables-multiport.conf | 11 +- fail2ban/action.d/nftables.conf | 203 ++ fail2ban/action.d/nginx-block-map.conf | 2 +- fail2ban/action.d/npf.conf | 4 +- fail2ban/action.d/nsupdate.conf | 4 +- fail2ban/action.d/osx-afctl.conf | 4 +- fail2ban/action.d/osx-ipfw.conf | 4 +- fail2ban/action.d/pf.conf | 4 +- fail2ban/action.d/sendmail-buffered.conf | 12 +- fail2ban/action.d/sendmail-common.conf | 12 +- fail2ban/action.d/sendmail-geoip-lines.conf | 4 +- .../sendmail-whois-ipjailmatches.conf | 5 +- .../action.d/sendmail-whois-ipmatches.conf | 5 +- fail2ban/action.d/sendmail-whois-lines.conf | 9 +- fail2ban/action.d/sendmail-whois-matches.conf | 5 +- fail2ban/action.d/sendmail-whois.conf | 5 +- fail2ban/action.d/sendmail.conf | 2 +- fail2ban/action.d/shorewall-ipset-proto6.conf | 18 +- fail2ban/action.d/shorewall.conf | 6 +- fail2ban/action.d/smtp.py | 12 +- .../symbiosis-blacklist-allports.conf | 4 +- fail2ban/action.d/xarf-login-attack.conf | 28 +- fail2ban/fail2ban.conf | 21 +- fail2ban/filter.d/apache-auth.conf | 15 +- fail2ban/filter.d/apache-common.conf | 4 +- fail2ban/filter.d/apache-modsecurity.conf | 2 +- fail2ban/filter.d/apache-noscript.conf | 9 +- fail2ban/filter.d/asterisk.conf | 15 +- fail2ban/filter.d/bitwarden.conf | 6 + fail2ban/filter.d/centreon.conf | 9 + fail2ban/filter.d/common.conf | 28 +- fail2ban/filter.d/domino-smtp.conf | 9 +- fail2ban/filter.d/dovecot.conf | 6 +- fail2ban/filter.d/exim.conf | 2 +- fail2ban/filter.d/freeswitch.conf | 32 +- .../ignorecommands/apache-fakegooglebot | 2 +- fail2ban/filter.d/murmur.conf | 15 +- fail2ban/filter.d/mysqld-auth.conf | 4 +- fail2ban/filter.d/named-refused.conf | 8 +- fail2ban/filter.d/pam-generic.conf | 9 +- fail2ban/filter.d/postfix.conf | 21 +- fail2ban/filter.d/recidive.conf | 12 +- fail2ban/filter.d/sendmail-auth.conf | 4 +- fail2ban/filter.d/sendmail-reject.conf | 17 +- fail2ban/filter.d/sogo-auth.conf | 2 +- fail2ban/filter.d/sshd.conf | 64 +- fail2ban/filter.d/traefik-auth.conf | 56 + fail2ban/filter.d/znc-adminlog.conf | 34 + fail2ban/jail.conf | 85 +- fonts/conf.avail/10-autohint.conf | 5 + fonts/conf.avail/10-hinting-full.conf | 6 + fonts/conf.avail/10-hinting-medium.conf | 6 + fonts/conf.avail/10-hinting-none.conf | 6 + fonts/conf.avail/10-hinting-slight.conf | 6 + fonts/conf.avail/10-no-sub-pixel.conf | 5 + fonts/conf.avail/10-scale-bitmap-fonts.conf | 4 + fonts/conf.avail/10-sub-pixel-bgr.conf | 5 + fonts/conf.avail/10-sub-pixel-rgb.conf | 5 + fonts/conf.avail/10-sub-pixel-vbgr.conf | 5 + fonts/conf.avail/10-sub-pixel-vrgb.conf | 5 + fonts/conf.avail/10-unhinted.conf | 5 + fonts/conf.avail/11-lcdfilter-default.conf | 5 + fonts/conf.avail/11-lcdfilter-legacy.conf | 5 + fonts/conf.avail/11-lcdfilter-light.conf | 5 + fonts/conf.avail/20-unhint-small-vera.conf | 5 + fonts/conf.avail/25-unhint-nonlatin.conf | 4 + fonts/conf.avail/30-metric-aliases.conf | 5 + fonts/conf.avail/40-nonlatin.conf | 5 + fonts/conf.avail/45-generic.conf | 22 +- fonts/conf.avail/45-latin.conf | 5 + fonts/conf.avail/49-sansserif.conf | 5 + fonts/conf.avail/50-user.conf | 5 + fonts/conf.avail/51-local.conf | 5 + fonts/conf.avail/53-monospace-lcd-filter.conf | 14 + fonts/conf.avail/60-generic.conf | 10 +- fonts/conf.avail/60-latin.conf | 5 + .../64-language-selector-prefer.conf | 2 + fonts/conf.avail/65-fonts-persian.conf | 4 + fonts/conf.avail/65-khmer.conf | 4 + fonts/conf.avail/65-nonlatin.conf | 5 + fonts/conf.avail/69-unifont.conf | 4 + fonts/conf.avail/70-force-bitmaps.conf | 5 + fonts/conf.avail/70-no-bitmaps.conf | 5 + fonts/conf.avail/80-delicious.conf | 4 + fonts/conf.avail/90-synthetic.conf | 10 +- fonts/fonts.conf | 5 + group | 4 + group- | 4 + grub.d/00_header | 27 + grub.d/10_linux | 170 +- grub.d/10_linux_zfs | 1108 ++++++++++ grub.d/20_linux_xen | 75 +- grub.d/30_uefi-firmware | 4 +- gshadow | 4 + gshadow- | 4 + hdparm.conf | 4 + init.d/amavis | 4 +- init.d/amavis-mc | 15 +- init.d/amavisd-snmp-subagent | 15 +- init.d/apparmor | 167 +- init.d/cron | 4 +- init.d/dbus | 7 + init.d/fail2ban | 145 +- init.d/irqbalance | 11 +- init.d/{bind9 => named} | 27 +- init.d/opendmarc | 2 +- init.d/postfix | 17 +- init.d/procps | 52 +- init.d/rsync | 12 +- init.d/spamassassin | 4 +- init.d/ssh | 12 +- init.d/udev | 104 +- initramfs-tools/initramfs.conf | 14 +- iproute2/ematch_map | 1 + iproute2/rt_protos | 18 +- issue | 2 +- issue.net | 2 +- kernel/postinst.d/initramfs-tools | 3 +- kernel/postrm.d/initramfs-tools | 3 +- logcheck/ignore.d.paranoid/mysql-server-8_0 | 9 + logcheck/ignore.d.server/gpg-agent | 4 +- logcheck/ignore.d.server/mysql-server-8_0 | 32 + logcheck/ignore.d.server/rsyslog | 7 +- .../ignore.d.workstation/mysql-server-8_0 | 32 + logrotate.conf | 24 +- logrotate.d/bootlog | 8 + logrotate.d/btmp | 7 + logrotate.d/ubuntu-advantage-tools | 8 + logrotate.d/wtmp | 8 + lsb-release | 6 +- mail/m4/opendkim.m4 | 2 +- manpath.config | 1 + mecabrc | 16 + mime.types | 12 +- mke2fs.conf | 5 +- modprobe.d/blacklist.conf | 4 - mysql/mysql.conf.d/mysql.cnf | 6 + mysql/mysql.conf.d/mysqld.cnf | 92 +- nanorc | 200 +- network/if-up.d/openssh-server | 42 - pam.d/login | 36 +- pam.d/su-l | 6 + passwd | 2 + passwd- | 2 + php/7.4/apache2/conf.d/10-mysqlnd.ini | 1 + php/7.4/apache2/conf.d/10-opcache.ini | 1 + php/7.4/apache2/conf.d/10-pdo.ini | 1 + php/7.4/apache2/conf.d/15-xml.ini | 1 + php/7.4/apache2/conf.d/20-bz2.ini | 1 + php/7.4/apache2/conf.d/20-calendar.ini | 1 + php/7.4/apache2/conf.d/20-ctype.ini | 1 + php/7.4/apache2/conf.d/20-curl.ini | 1 + php/7.4/apache2/conf.d/20-dom.ini | 1 + php/7.4/apache2/conf.d/20-exif.ini | 1 + php/7.4/apache2/conf.d/20-ffi.ini | 1 + php/7.4/apache2/conf.d/20-fileinfo.ini | 1 + php/7.4/apache2/conf.d/20-ftp.ini | 1 + php/7.4/apache2/conf.d/20-gd.ini | 1 + php/7.4/apache2/conf.d/20-gettext.ini | 1 + php/7.4/apache2/conf.d/20-iconv.ini | 1 + php/7.4/apache2/conf.d/20-igbinary.ini | 1 + php/7.4/apache2/conf.d/20-json.ini | 1 + php/7.4/apache2/conf.d/20-mbstring.ini | 1 + php/7.4/apache2/conf.d/20-memcache.ini | 1 + php/7.4/apache2/conf.d/20-mysqli.ini | 1 + php/7.4/apache2/conf.d/20-pdo_mysql.ini | 1 + php/7.4/apache2/conf.d/20-phar.ini | 1 + php/7.4/apache2/conf.d/20-posix.ini | 1 + php/7.4/apache2/conf.d/20-readline.ini | 1 + php/7.4/apache2/conf.d/20-redis.ini | 1 + php/7.4/apache2/conf.d/20-shmop.ini | 1 + php/7.4/apache2/conf.d/20-simplexml.ini | 1 + php/7.4/apache2/conf.d/20-sockets.ini | 1 + php/7.4/apache2/conf.d/20-sysvmsg.ini | 1 + php/7.4/apache2/conf.d/20-sysvsem.ini | 1 + php/7.4/apache2/conf.d/20-sysvshm.ini | 1 + php/7.4/apache2/conf.d/20-tokenizer.ini | 1 + php/7.4/apache2/conf.d/20-xmlreader.ini | 1 + php/7.4/apache2/conf.d/20-xmlwriter.ini | 1 + php/7.4/apache2/conf.d/20-xsl.ini | 1 + php/7.4/apache2/conf.d/20-zip.ini | 1 + php/7.4/apache2/php.ini | 1946 +++++++++++++++++ php/7.4/cli/conf.d/10-mysqlnd.ini | 1 + php/7.4/cli/conf.d/10-opcache.ini | 1 + php/7.4/cli/conf.d/10-pdo.ini | 1 + php/7.4/cli/conf.d/15-xml.ini | 1 + php/7.4/cli/conf.d/20-bz2.ini | 1 + php/7.4/cli/conf.d/20-calendar.ini | 1 + php/7.4/cli/conf.d/20-ctype.ini | 1 + php/7.4/cli/conf.d/20-curl.ini | 1 + php/7.4/cli/conf.d/20-dom.ini | 1 + php/7.4/cli/conf.d/20-exif.ini | 1 + php/7.4/cli/conf.d/20-ffi.ini | 1 + php/7.4/cli/conf.d/20-fileinfo.ini | 1 + php/7.4/cli/conf.d/20-ftp.ini | 1 + php/7.4/cli/conf.d/20-gd.ini | 1 + php/7.4/cli/conf.d/20-gettext.ini | 1 + php/7.4/cli/conf.d/20-iconv.ini | 1 + php/7.4/cli/conf.d/20-igbinary.ini | 1 + php/7.4/cli/conf.d/20-json.ini | 1 + php/7.4/cli/conf.d/20-mbstring.ini | 1 + php/7.4/cli/conf.d/20-memcache.ini | 1 + php/7.4/cli/conf.d/20-mysqli.ini | 1 + php/7.4/cli/conf.d/20-pdo_mysql.ini | 1 + php/7.4/cli/conf.d/20-phar.ini | 1 + php/7.4/cli/conf.d/20-posix.ini | 1 + php/7.4/cli/conf.d/20-readline.ini | 1 + php/7.4/cli/conf.d/20-redis.ini | 1 + php/7.4/cli/conf.d/20-shmop.ini | 1 + php/7.4/cli/conf.d/20-simplexml.ini | 1 + php/7.4/cli/conf.d/20-sockets.ini | 1 + php/7.4/cli/conf.d/20-sysvmsg.ini | 1 + php/7.4/cli/conf.d/20-sysvsem.ini | 1 + php/7.4/cli/conf.d/20-sysvshm.ini | 1 + php/7.4/cli/conf.d/20-tokenizer.ini | 1 + php/7.4/cli/conf.d/20-xmlreader.ini | 1 + php/7.4/cli/conf.d/20-xmlwriter.ini | 1 + php/7.4/cli/conf.d/20-xsl.ini | 1 + php/7.4/cli/conf.d/20-zip.ini | 1 + php/7.4/cli/php.ini | 1946 +++++++++++++++++ php/7.4/mods-available/bz2.ini | 3 + php/7.4/mods-available/calendar.ini | 3 + php/7.4/mods-available/ctype.ini | 3 + php/7.4/mods-available/curl.ini | 3 + php/7.4/mods-available/dom.ini | 3 + php/7.4/mods-available/exif.ini | 3 + php/7.4/mods-available/ffi.ini | 3 + php/7.4/mods-available/fileinfo.ini | 3 + php/7.4/mods-available/ftp.ini | 3 + php/7.4/mods-available/gd.ini | 3 + php/7.4/mods-available/gettext.ini | 3 + php/7.4/mods-available/iconv.ini | 3 + php/{7.2 => 7.4}/mods-available/igbinary.ini | 0 php/7.4/mods-available/json.ini | 3 + php/7.4/mods-available/mbstring.ini | 3 + php/{7.2 => 7.4}/mods-available/memcache.ini | 0 php/7.4/mods-available/mysqli.ini | 3 + php/7.4/mods-available/mysqlnd.ini | 3 + php/7.4/mods-available/opcache.ini | 3 + php/7.4/mods-available/pdo.ini | 3 + php/7.4/mods-available/pdo_mysql.ini | 3 + php/7.4/mods-available/phar.ini | 3 + php/7.4/mods-available/posix.ini | 3 + php/7.4/mods-available/readline.ini | 3 + php/{7.2 => 7.4}/mods-available/redis.ini | 0 php/7.4/mods-available/shmop.ini | 3 + php/7.4/mods-available/simplexml.ini | 3 + php/7.4/mods-available/sockets.ini | 3 + php/7.4/mods-available/sysvmsg.ini | 3 + php/7.4/mods-available/sysvsem.ini | 3 + php/7.4/mods-available/sysvshm.ini | 3 + php/7.4/mods-available/tokenizer.ini | 3 + php/7.4/mods-available/xml.ini | 3 + php/7.4/mods-available/xmlreader.ini | 3 + php/7.4/mods-available/xmlwriter.ini | 3 + php/7.4/mods-available/xsl.ini | 3 + php/7.4/mods-available/zip.ini | 3 + php/7.4/phpdbg/conf.d/10-mysqlnd.ini | 1 + php/7.4/phpdbg/conf.d/10-opcache.ini | 1 + php/7.4/phpdbg/conf.d/10-pdo.ini | 1 + php/7.4/phpdbg/conf.d/15-xml.ini | 1 + php/7.4/phpdbg/conf.d/20-bz2.ini | 1 + php/7.4/phpdbg/conf.d/20-calendar.ini | 1 + php/7.4/phpdbg/conf.d/20-ctype.ini | 1 + php/7.4/phpdbg/conf.d/20-curl.ini | 1 + php/7.4/phpdbg/conf.d/20-dom.ini | 1 + php/7.4/phpdbg/conf.d/20-exif.ini | 1 + php/7.4/phpdbg/conf.d/20-ffi.ini | 1 + php/7.4/phpdbg/conf.d/20-fileinfo.ini | 1 + php/7.4/phpdbg/conf.d/20-ftp.ini | 1 + php/7.4/phpdbg/conf.d/20-gd.ini | 1 + php/7.4/phpdbg/conf.d/20-gettext.ini | 1 + php/7.4/phpdbg/conf.d/20-iconv.ini | 1 + php/7.4/phpdbg/conf.d/20-igbinary.ini | 1 + php/7.4/phpdbg/conf.d/20-json.ini | 1 + php/7.4/phpdbg/conf.d/20-mbstring.ini | 1 + php/7.4/phpdbg/conf.d/20-memcache.ini | 1 + php/7.4/phpdbg/conf.d/20-mysqli.ini | 1 + php/7.4/phpdbg/conf.d/20-pdo_mysql.ini | 1 + php/7.4/phpdbg/conf.d/20-phar.ini | 1 + php/7.4/phpdbg/conf.d/20-posix.ini | 1 + php/7.4/phpdbg/conf.d/20-readline.ini | 1 + php/7.4/phpdbg/conf.d/20-redis.ini | 1 + php/7.4/phpdbg/conf.d/20-shmop.ini | 1 + php/7.4/phpdbg/conf.d/20-simplexml.ini | 1 + php/7.4/phpdbg/conf.d/20-sockets.ini | 1 + php/7.4/phpdbg/conf.d/20-sysvmsg.ini | 1 + php/7.4/phpdbg/conf.d/20-sysvsem.ini | 1 + php/7.4/phpdbg/conf.d/20-sysvshm.ini | 1 + php/7.4/phpdbg/conf.d/20-tokenizer.ini | 1 + php/7.4/phpdbg/conf.d/20-xmlreader.ini | 1 + php/7.4/phpdbg/conf.d/20-xmlwriter.ini | 1 + php/7.4/phpdbg/conf.d/20-xsl.ini | 1 + php/7.4/phpdbg/conf.d/20-zip.ini | 1 + php/7.4/phpdbg/php.ini | 1946 +++++++++++++++++ phpmyadmin/apache.conf | 42 +- phpmyadmin/lighttpd.conf | 28 +- postfix/makedefs.out | 66 +- postfix/post-install | 10 + postfix/postfix-files | 2 + postfix/postfix-script | 62 +- profile.d/bash_completion.sh | 7 +- python3.8/sitecustomize.py | 7 + rc0.d/K01ipsec | 1 + rc0.d/K01named | 1 + rc0.d/K01udev | 1 + rc1.d/K01ipsec | 1 + rc1.d/K01named | 1 + rc2.d/S01ipsec | 1 + rc2.d/S01named | 1 + rc3.d/S01ipsec | 1 + rc3.d/S01named | 1 + rc4.d/S01ipsec | 1 + rc4.d/S01named | 1 + rc5.d/S01ipsec | 1 + rc5.d/S01named | 1 + rc6.d/K01ipsec | 1 + rc6.d/K01named | 1 + rc6.d/K01udev | 1 + rmt | 9 +- rsyslog.conf | 8 +- securetty | 412 ---- security/access.conf | 28 +- security/limits.conf | 2 +- sensors3.conf | 25 +- services | 206 +- shadow | 2 + shadow- | 2 + spamassassin/init.pre | 4 - spamassassin/v342.pre | 7 +- spamassassin/v343.pre | 25 + ssh/moduli | 833 ++++--- ssh/ssh_config | 3 +- ssh/ssh_import_id | 4 +- strongswan.d/charon-logging.conf | 11 +- strongswan.d/charon.conf | 18 +- strongswan.d/charon/drbg.conf | 12 + strongswan.d/charon/kernel-netlink.conf | 3 + sysctl.conf | 16 +- sysctl.d/10-link-restrictions.conf | 5 - sysctl.d/10-network-security.conf | 10 +- sysctl.d/README.sysctl | 16 + systemd/journald.conf | 3 +- systemd/logind.conf | 2 +- systemd/networkd.conf | 20 + systemd/pstore.conf | 16 + systemd/resolved.conf | 2 + systemd/sleep.conf | 25 + systemd/system.conf | 15 +- systemd/system/bind9.service | 1 + .../dbus-org.freedesktop.timesync1.service | 1 + .../default.target.wants/e2scrub_reap.service | 1 + .../grub-initrd-fallback.service | 1 + .../multi-user.target.wants/dmesg.service | 1 + .../multi-user.target.wants/etckeeper.timer | 1 + .../grub-initrd-fallback.service | 1 + .../multi-user.target.wants/named.service | 1 + .../strongswan-starter.service | 1 + .../grub-initrd-fallback.service | 1 + .../systemd-pstore.service | 1 + .../timers.target.wants/e2scrub_all.timer | 1 + .../timers.target.wants/logrotate.timer | 1 + .../system/timers.target.wants/man-db.timer | 1 + systemd/user.conf | 2 + .../user/sockets.target.wants/dirmngr.socket | 1 + .../gpg-agent-browser.socket | 1 + .../gpg-agent-extra.socket | 1 + .../sockets.target.wants/gpg-agent-ssh.socket | 1 + .../sockets.target.wants/gpg-agent.socket | 1 + ubuntu-advantage/uaclient.conf | 5 + udev/udev.conf | 10 +- update-manager/release-upgrades | 2 +- update-motd.d/50-motd-news | 4 +- update-motd.d/80-esm | 24 - update-motd.d/80-livepatch | 93 - updatedb.conf | 2 +- vim/vimrc | 10 +- vim/vimrc.tiny | 2 +- xattr.conf | 21 + 580 files changed, 11857 insertions(+), 3900 deletions(-) create mode 100644 aide/aide.conf.d/31_aide_boinc-client create mode 100644 aide/aide.conf.d/31_aide_crack create mode 120000 alternatives/arptables create mode 120000 alternatives/arptables-restore create mode 120000 alternatives/arptables-save create mode 120000 alternatives/ebtables create mode 120000 alternatives/ebtables-restore create mode 120000 alternatives/ebtables-save create mode 120000 alternatives/editor.da.1.gz create mode 120000 alternatives/editor.de.1.gz create mode 120000 alternatives/ex.da.1.gz create mode 120000 alternatives/ex.de.1.gz create mode 120000 alternatives/ip6tables create mode 120000 alternatives/ip6tables-restore create mode 120000 alternatives/ip6tables-save create mode 120000 alternatives/iptables create mode 120000 alternatives/iptables-restore create mode 120000 alternatives/iptables-save create mode 120000 alternatives/mecab-dictionary create mode 120000 alternatives/phpdbg create mode 120000 alternatives/phpdbg.1.gz create mode 120000 alternatives/vi.da.1.gz create mode 120000 alternatives/vi.de.1.gz create mode 120000 alternatives/view.da.1.gz create mode 120000 alternatives/view.de.1.gz create mode 100644 apache2/mods-available/php7.4.conf create mode 100644 apache2/mods-available/php7.4.load delete mode 120000 apache2/mods-enabled/php7.2.conf delete mode 120000 apache2/mods-enabled/php7.2.load create mode 120000 apache2/mods-enabled/php7.4.conf create mode 120000 apache2/mods-enabled/php7.4.load delete mode 100755 apm/event.d/20hdparm create mode 100644 apparmor.d/abstractions/dri-common create mode 100644 apparmor.d/abstractions/dri-enumerate create mode 100644 apparmor.d/abstractions/kde-globals-write create mode 100644 apparmor.d/abstractions/kde-icon-cache-write create mode 100644 apparmor.d/abstractions/kde-language-write delete mode 100644 apparmor.d/abstractions/launchpad-integration create mode 100644 apparmor.d/abstractions/mesa create mode 100644 apparmor.d/abstractions/opencl create mode 100644 apparmor.d/abstractions/opencl-common create mode 100644 apparmor.d/abstractions/opencl-intel create mode 100644 apparmor.d/abstractions/opencl-mesa create mode 100644 apparmor.d/abstractions/opencl-nvidia create mode 100644 apparmor.d/abstractions/opencl-pocl create mode 100644 apparmor.d/abstractions/qt5 create mode 100644 apparmor.d/abstractions/qt5-compose-cache-write create mode 100644 apparmor.d/abstractions/qt5-settings-write create mode 100644 apparmor.d/abstractions/recent-documents-write create mode 100644 apparmor.d/abstractions/vulkan create mode 100644 apparmor.d/local/lsb_release create mode 100644 apparmor.d/local/nvidia_modprobe create mode 100644 apparmor.d/lsb_release create mode 100644 apparmor.d/nvidia_modprobe create mode 100644 apparmor.d/tunables/share delete mode 100644 apparmor/subdomain.conf create mode 100644 avahi/services/phpmyadmin.service delete mode 100644 bash_completion.d/grub create mode 100644 cron.d/e2scrub_all delete mode 100755 cron.daily/passwd delete mode 100755 cron.daily/ubuntu-advantage-tools create mode 100644 dbconfig-common/opendmarc.conf create mode 100644 default/grub.d/init-select.cfg create mode 100644 default/named delete mode 100644 default/rsyslog create mode 100644 e2scrub.conf delete mode 100644 emacs/site-start.d/00debian-vars.el delete mode 100644 emacs/site-start.el create mode 100644 ethertypes create mode 100644 fail2ban/action.d/nftables.conf create mode 100644 fail2ban/filter.d/bitwarden.conf create mode 100644 fail2ban/filter.d/centreon.conf create mode 100644 fail2ban/filter.d/traefik-auth.conf create mode 100644 fail2ban/filter.d/znc-adminlog.conf create mode 100755 grub.d/10_linux_zfs rename init.d/{bind9 => named} (78%) create mode 100644 logcheck/ignore.d.paranoid/mysql-server-8_0 create mode 100644 logcheck/ignore.d.server/mysql-server-8_0 create mode 100644 logcheck/ignore.d.workstation/mysql-server-8_0 create mode 100644 logrotate.d/bootlog create mode 100644 logrotate.d/btmp create mode 100644 logrotate.d/ubuntu-advantage-tools create mode 100644 logrotate.d/wtmp create mode 100644 mecabrc create mode 100644 mysql/mysql.conf.d/mysql.cnf delete mode 100755 network/if-up.d/openssh-server create mode 100644 pam.d/su-l create mode 120000 php/7.4/apache2/conf.d/10-mysqlnd.ini create mode 120000 php/7.4/apache2/conf.d/10-opcache.ini create mode 120000 php/7.4/apache2/conf.d/10-pdo.ini create mode 120000 php/7.4/apache2/conf.d/15-xml.ini create mode 120000 php/7.4/apache2/conf.d/20-bz2.ini create mode 120000 php/7.4/apache2/conf.d/20-calendar.ini create mode 120000 php/7.4/apache2/conf.d/20-ctype.ini create mode 120000 php/7.4/apache2/conf.d/20-curl.ini create mode 120000 php/7.4/apache2/conf.d/20-dom.ini create mode 120000 php/7.4/apache2/conf.d/20-exif.ini create mode 120000 php/7.4/apache2/conf.d/20-ffi.ini create mode 120000 php/7.4/apache2/conf.d/20-fileinfo.ini create mode 120000 php/7.4/apache2/conf.d/20-ftp.ini create mode 120000 php/7.4/apache2/conf.d/20-gd.ini create mode 120000 php/7.4/apache2/conf.d/20-gettext.ini create mode 120000 php/7.4/apache2/conf.d/20-iconv.ini create mode 120000 php/7.4/apache2/conf.d/20-igbinary.ini create mode 120000 php/7.4/apache2/conf.d/20-json.ini create mode 120000 php/7.4/apache2/conf.d/20-mbstring.ini create mode 120000 php/7.4/apache2/conf.d/20-memcache.ini create mode 120000 php/7.4/apache2/conf.d/20-mysqli.ini create mode 120000 php/7.4/apache2/conf.d/20-pdo_mysql.ini create mode 120000 php/7.4/apache2/conf.d/20-phar.ini create mode 120000 php/7.4/apache2/conf.d/20-posix.ini create mode 120000 php/7.4/apache2/conf.d/20-readline.ini create mode 120000 php/7.4/apache2/conf.d/20-redis.ini create mode 120000 php/7.4/apache2/conf.d/20-shmop.ini create mode 120000 php/7.4/apache2/conf.d/20-simplexml.ini create mode 120000 php/7.4/apache2/conf.d/20-sockets.ini create mode 120000 php/7.4/apache2/conf.d/20-sysvmsg.ini create mode 120000 php/7.4/apache2/conf.d/20-sysvsem.ini create mode 120000 php/7.4/apache2/conf.d/20-sysvshm.ini create mode 120000 php/7.4/apache2/conf.d/20-tokenizer.ini create mode 120000 php/7.4/apache2/conf.d/20-xmlreader.ini create mode 120000 php/7.4/apache2/conf.d/20-xmlwriter.ini create mode 120000 php/7.4/apache2/conf.d/20-xsl.ini create mode 120000 php/7.4/apache2/conf.d/20-zip.ini create mode 100644 php/7.4/apache2/php.ini create mode 120000 php/7.4/cli/conf.d/10-mysqlnd.ini create mode 120000 php/7.4/cli/conf.d/10-opcache.ini create mode 120000 php/7.4/cli/conf.d/10-pdo.ini create mode 120000 php/7.4/cli/conf.d/15-xml.ini create mode 120000 php/7.4/cli/conf.d/20-bz2.ini create mode 120000 php/7.4/cli/conf.d/20-calendar.ini create mode 120000 php/7.4/cli/conf.d/20-ctype.ini create mode 120000 php/7.4/cli/conf.d/20-curl.ini create mode 120000 php/7.4/cli/conf.d/20-dom.ini create mode 120000 php/7.4/cli/conf.d/20-exif.ini create mode 120000 php/7.4/cli/conf.d/20-ffi.ini create mode 120000 php/7.4/cli/conf.d/20-fileinfo.ini create mode 120000 php/7.4/cli/conf.d/20-ftp.ini create mode 120000 php/7.4/cli/conf.d/20-gd.ini create mode 120000 php/7.4/cli/conf.d/20-gettext.ini create mode 120000 php/7.4/cli/conf.d/20-iconv.ini create mode 120000 php/7.4/cli/conf.d/20-igbinary.ini create mode 120000 php/7.4/cli/conf.d/20-json.ini create mode 120000 php/7.4/cli/conf.d/20-mbstring.ini create mode 120000 php/7.4/cli/conf.d/20-memcache.ini create mode 120000 php/7.4/cli/conf.d/20-mysqli.ini create mode 120000 php/7.4/cli/conf.d/20-pdo_mysql.ini create mode 120000 php/7.4/cli/conf.d/20-phar.ini create mode 120000 php/7.4/cli/conf.d/20-posix.ini create mode 120000 php/7.4/cli/conf.d/20-readline.ini create mode 120000 php/7.4/cli/conf.d/20-redis.ini create mode 120000 php/7.4/cli/conf.d/20-shmop.ini create mode 120000 php/7.4/cli/conf.d/20-simplexml.ini create mode 120000 php/7.4/cli/conf.d/20-sockets.ini create mode 120000 php/7.4/cli/conf.d/20-sysvmsg.ini create mode 120000 php/7.4/cli/conf.d/20-sysvsem.ini create mode 120000 php/7.4/cli/conf.d/20-sysvshm.ini create mode 120000 php/7.4/cli/conf.d/20-tokenizer.ini create mode 120000 php/7.4/cli/conf.d/20-xmlreader.ini create mode 120000 php/7.4/cli/conf.d/20-xmlwriter.ini create mode 120000 php/7.4/cli/conf.d/20-xsl.ini create mode 120000 php/7.4/cli/conf.d/20-zip.ini create mode 100644 php/7.4/cli/php.ini create mode 100644 php/7.4/mods-available/bz2.ini create mode 100644 php/7.4/mods-available/calendar.ini create mode 100644 php/7.4/mods-available/ctype.ini create mode 100644 php/7.4/mods-available/curl.ini create mode 100644 php/7.4/mods-available/dom.ini create mode 100644 php/7.4/mods-available/exif.ini create mode 100644 php/7.4/mods-available/ffi.ini create mode 100644 php/7.4/mods-available/fileinfo.ini create mode 100644 php/7.4/mods-available/ftp.ini create mode 100644 php/7.4/mods-available/gd.ini create mode 100644 php/7.4/mods-available/gettext.ini create mode 100644 php/7.4/mods-available/iconv.ini rename php/{7.2 => 7.4}/mods-available/igbinary.ini (100%) create mode 100644 php/7.4/mods-available/json.ini create mode 100644 php/7.4/mods-available/mbstring.ini rename php/{7.2 => 7.4}/mods-available/memcache.ini (100%) create mode 100644 php/7.4/mods-available/mysqli.ini create mode 100644 php/7.4/mods-available/mysqlnd.ini create mode 100644 php/7.4/mods-available/opcache.ini create mode 100644 php/7.4/mods-available/pdo.ini create mode 100644 php/7.4/mods-available/pdo_mysql.ini create mode 100644 php/7.4/mods-available/phar.ini create mode 100644 php/7.4/mods-available/posix.ini create mode 100644 php/7.4/mods-available/readline.ini rename php/{7.2 => 7.4}/mods-available/redis.ini (100%) create mode 100644 php/7.4/mods-available/shmop.ini create mode 100644 php/7.4/mods-available/simplexml.ini create mode 100644 php/7.4/mods-available/sockets.ini create mode 100644 php/7.4/mods-available/sysvmsg.ini create mode 100644 php/7.4/mods-available/sysvsem.ini create mode 100644 php/7.4/mods-available/sysvshm.ini create mode 100644 php/7.4/mods-available/tokenizer.ini create mode 100644 php/7.4/mods-available/xml.ini create mode 100644 php/7.4/mods-available/xmlreader.ini create mode 100644 php/7.4/mods-available/xmlwriter.ini create mode 100644 php/7.4/mods-available/xsl.ini create mode 100644 php/7.4/mods-available/zip.ini create mode 120000 php/7.4/phpdbg/conf.d/10-mysqlnd.ini create mode 120000 php/7.4/phpdbg/conf.d/10-opcache.ini create mode 120000 php/7.4/phpdbg/conf.d/10-pdo.ini create mode 120000 php/7.4/phpdbg/conf.d/15-xml.ini create mode 120000 php/7.4/phpdbg/conf.d/20-bz2.ini create mode 120000 php/7.4/phpdbg/conf.d/20-calendar.ini create mode 120000 php/7.4/phpdbg/conf.d/20-ctype.ini create mode 120000 php/7.4/phpdbg/conf.d/20-curl.ini create mode 120000 php/7.4/phpdbg/conf.d/20-dom.ini create mode 120000 php/7.4/phpdbg/conf.d/20-exif.ini create mode 120000 php/7.4/phpdbg/conf.d/20-ffi.ini create mode 120000 php/7.4/phpdbg/conf.d/20-fileinfo.ini create mode 120000 php/7.4/phpdbg/conf.d/20-ftp.ini create mode 120000 php/7.4/phpdbg/conf.d/20-gd.ini create mode 120000 php/7.4/phpdbg/conf.d/20-gettext.ini create mode 120000 php/7.4/phpdbg/conf.d/20-iconv.ini create mode 120000 php/7.4/phpdbg/conf.d/20-igbinary.ini create mode 120000 php/7.4/phpdbg/conf.d/20-json.ini create mode 120000 php/7.4/phpdbg/conf.d/20-mbstring.ini create mode 120000 php/7.4/phpdbg/conf.d/20-memcache.ini create mode 120000 php/7.4/phpdbg/conf.d/20-mysqli.ini create mode 120000 php/7.4/phpdbg/conf.d/20-pdo_mysql.ini create mode 120000 php/7.4/phpdbg/conf.d/20-phar.ini create mode 120000 php/7.4/phpdbg/conf.d/20-posix.ini create mode 120000 php/7.4/phpdbg/conf.d/20-readline.ini create mode 120000 php/7.4/phpdbg/conf.d/20-redis.ini create mode 120000 php/7.4/phpdbg/conf.d/20-shmop.ini create mode 120000 php/7.4/phpdbg/conf.d/20-simplexml.ini create mode 120000 php/7.4/phpdbg/conf.d/20-sockets.ini create mode 120000 php/7.4/phpdbg/conf.d/20-sysvmsg.ini create mode 120000 php/7.4/phpdbg/conf.d/20-sysvsem.ini create mode 120000 php/7.4/phpdbg/conf.d/20-sysvshm.ini create mode 120000 php/7.4/phpdbg/conf.d/20-tokenizer.ini create mode 120000 php/7.4/phpdbg/conf.d/20-xmlreader.ini create mode 120000 php/7.4/phpdbg/conf.d/20-xmlwriter.ini create mode 120000 php/7.4/phpdbg/conf.d/20-xsl.ini create mode 120000 php/7.4/phpdbg/conf.d/20-zip.ini create mode 100644 php/7.4/phpdbg/php.ini mode change 100644 => 120000 postfix/makedefs.out create mode 100644 python3.8/sitecustomize.py create mode 120000 rc0.d/K01ipsec create mode 120000 rc0.d/K01named create mode 120000 rc0.d/K01udev create mode 120000 rc1.d/K01ipsec create mode 120000 rc1.d/K01named create mode 120000 rc2.d/S01ipsec create mode 120000 rc2.d/S01named create mode 120000 rc3.d/S01ipsec create mode 120000 rc3.d/S01named create mode 120000 rc4.d/S01ipsec create mode 120000 rc4.d/S01named create mode 120000 rc5.d/S01ipsec create mode 120000 rc5.d/S01named create mode 120000 rc6.d/K01ipsec create mode 120000 rc6.d/K01named create mode 120000 rc6.d/K01udev mode change 100755 => 120000 rmt delete mode 100644 securetty create mode 100644 spamassassin/v343.pre create mode 100644 strongswan.d/charon/drbg.conf delete mode 100644 sysctl.d/10-link-restrictions.conf create mode 100644 sysctl.d/README.sysctl create mode 100644 systemd/networkd.conf create mode 100644 systemd/pstore.conf create mode 100644 systemd/sleep.conf create mode 120000 systemd/system/bind9.service create mode 120000 systemd/system/dbus-org.freedesktop.timesync1.service create mode 120000 systemd/system/default.target.wants/e2scrub_reap.service create mode 120000 systemd/system/emergency.target.wants/grub-initrd-fallback.service create mode 120000 systemd/system/multi-user.target.wants/dmesg.service create mode 120000 systemd/system/multi-user.target.wants/etckeeper.timer create mode 120000 systemd/system/multi-user.target.wants/grub-initrd-fallback.service create mode 120000 systemd/system/multi-user.target.wants/named.service create mode 120000 systemd/system/multi-user.target.wants/strongswan-starter.service create mode 120000 systemd/system/rescue.target.wants/grub-initrd-fallback.service create mode 120000 systemd/system/sysinit.target.wants/systemd-pstore.service create mode 120000 systemd/system/timers.target.wants/e2scrub_all.timer create mode 120000 systemd/system/timers.target.wants/logrotate.timer create mode 120000 systemd/system/timers.target.wants/man-db.timer create mode 120000 systemd/user/sockets.target.wants/dirmngr.socket create mode 120000 systemd/user/sockets.target.wants/gpg-agent-browser.socket create mode 120000 systemd/user/sockets.target.wants/gpg-agent-extra.socket create mode 120000 systemd/user/sockets.target.wants/gpg-agent-ssh.socket create mode 120000 systemd/user/sockets.target.wants/gpg-agent.socket create mode 100644 ubuntu-advantage/uaclient.conf delete mode 100755 update-motd.d/80-esm delete mode 100755 update-motd.d/80-livepatch create mode 100644 xattr.conf diff --git a/.etckeeper b/.etckeeper index 3b8ce236f..0920d1ad8 100755 --- a/.etckeeper +++ b/.etckeeper @@ -2,13 +2,13 @@ mkdir -p './X11/xkb' mkdir -p './acpi/events' +mkdir -p './apm/event.d' mkdir -p './apparmor.d/force-complain' mkdir -p './apt/auth.conf.d' mkdir -p './apt/preferences.d' mkdir -p './binfmt.d' mkdir -p './ca-certificates/update.d' mkdir -p './dbus-1/session.d' -mkdir -p './dovecot/conf.d' mkdir -p './dovecot/private' mkdir -p './dpkg/dpkg.cfg.d' mkdir -p './fail2ban/fail2ban.d' @@ -40,23 +40,28 @@ mkdir -p './letsencrypt/renewal-hooks/post' mkdir -p './letsencrypt/renewal-hooks/pre' mkdir -p './logcheck/violations.ignore.d' mkdir -p './monit/conf-available' +mkdir -p './networkd-dispatcher/carrier.d' +mkdir -p './networkd-dispatcher/degraded.d' mkdir -p './networkd-dispatcher/dormant.d' mkdir -p './networkd-dispatcher/no-carrier.d' mkdir -p './networkd-dispatcher/off.d' mkdir -p './networkd-dispatcher/routable.d' mkdir -p './opt' -mkdir -p './perl/CPAN' mkdir -p './phpmyadmin/conf.d' mkdir -p './postfix/dynamicmaps.cf.d' mkdir -p './postfix/sasl' mkdir -p './security/limits.d' mkdir -p './security/namespace.d' mkdir -p './spamassassin/sa-update-keys/private-keys-v1.d' +mkdir -p './ssh/ssh_config.d' +mkdir -p './ssh/sshd_config.d' mkdir -p './systemd/network' -mkdir -p './systemd/user' mkdir -p './udev/hwdb.d' mkdir -p './udev/rules.d' mkdir -p './update-manager/release-upgrades.d' +mkdir -p './vulkan/explicit_layer.d' +mkdir -p './vulkan/icd.d' +mkdir -p './vulkan/implicit_layer.d' maybe chmod 0755 '.' maybe chmod 0700 '.etckeeper' maybe chmod 0600 '.gitignore' @@ -126,12 +131,14 @@ maybe chmod 0644 'aide/aide.conf.d/31_aide_aptitude_frqchg' maybe chmod 0644 'aide/aide.conf.d/31_aide_at' maybe chmod 0644 'aide/aide.conf.d/31_aide_atop' maybe chmod 0644 'aide/aide.conf.d/31_aide_bind9' +maybe chmod 0644 'aide/aide.conf.d/31_aide_boinc-client' maybe chmod 0644 'aide/aide.conf.d/31_aide_btmp' maybe chmod 0644 'aide/aide.conf.d/31_aide_cereal' maybe chmod 0644 'aide/aide.conf.d/31_aide_checksecurity' maybe chmod 0644 'aide/aide.conf.d/31_aide_clamav' maybe chmod 0644 'aide/aide.conf.d/31_aide_clamav-freshclam' maybe chmod 0644 'aide/aide.conf.d/31_aide_console-log' +maybe chmod 0644 'aide/aide.conf.d/31_aide_crack' maybe chmod 0644 'aide/aide.conf.d/31_aide_cracklib-runtime' maybe chmod 0644 'aide/aide.conf.d/31_aide_cron' maybe chmod 0644 'aide/aide.conf.d/31_aide_cron-apt' @@ -391,6 +398,8 @@ maybe chmod 0644 'apache2/mods-available/negotiation.conf' maybe chmod 0644 'apache2/mods-available/negotiation.load' maybe chmod 0644 'apache2/mods-available/php7.2.conf' maybe chmod 0644 'apache2/mods-available/php7.2.load' +maybe chmod 0644 'apache2/mods-available/php7.4.conf' +maybe chmod 0644 'apache2/mods-available/php7.4.load' maybe chmod 0644 'apache2/mods-available/proxy.conf' maybe chmod 0644 'apache2/mods-available/proxy.load' maybe chmod 0644 'apache2/mods-available/proxy_ajp.load' @@ -465,7 +474,6 @@ maybe chmod 0644 'apache2/sites-available/siedlerverein_local.conf' maybe chmod 0755 'apache2/sites-enabled' maybe chmod 0755 'apm' maybe chmod 0755 'apm/event.d' -maybe chmod 0755 'apm/event.d/20hdparm' maybe chmod 0755 'apparmor' maybe chmod 0755 'apparmor.d' maybe chmod 0755 'apparmor.d/abstractions' @@ -492,6 +500,8 @@ maybe chmod 0644 'apparmor.d/abstractions/dbus-session-strict' maybe chmod 0644 'apparmor.d/abstractions/dbus-strict' maybe chmod 0644 'apparmor.d/abstractions/dconf' maybe chmod 0644 'apparmor.d/abstractions/dovecot-common' +maybe chmod 0644 'apparmor.d/abstractions/dri-common' +maybe chmod 0644 'apparmor.d/abstractions/dri-enumerate' maybe chmod 0644 'apparmor.d/abstractions/enchant' maybe chmod 0644 'apparmor.d/abstractions/fcitx' maybe chmod 0644 'apparmor.d/abstractions/fcitx-strict' @@ -501,18 +511,27 @@ maybe chmod 0644 'apparmor.d/abstractions/gnome' maybe chmod 0644 'apparmor.d/abstractions/gnupg' maybe chmod 0644 'apparmor.d/abstractions/ibus' maybe chmod 0644 'apparmor.d/abstractions/kde' +maybe chmod 0644 'apparmor.d/abstractions/kde-globals-write' +maybe chmod 0644 'apparmor.d/abstractions/kde-icon-cache-write' +maybe chmod 0644 'apparmor.d/abstractions/kde-language-write' maybe chmod 0644 'apparmor.d/abstractions/kerberosclient' -maybe chmod 0644 'apparmor.d/abstractions/launchpad-integration' maybe chmod 0644 'apparmor.d/abstractions/ldapclient' maybe chmod 0644 'apparmor.d/abstractions/libpam-systemd' maybe chmod 0644 'apparmor.d/abstractions/likewise' maybe chmod 0644 'apparmor.d/abstractions/mdns' +maybe chmod 0644 'apparmor.d/abstractions/mesa' maybe chmod 0644 'apparmor.d/abstractions/mir' maybe chmod 0644 'apparmor.d/abstractions/mozc' maybe chmod 0644 'apparmor.d/abstractions/mysql' maybe chmod 0644 'apparmor.d/abstractions/nameservice' maybe chmod 0644 'apparmor.d/abstractions/nis' maybe chmod 0644 'apparmor.d/abstractions/nvidia' +maybe chmod 0644 'apparmor.d/abstractions/opencl' +maybe chmod 0644 'apparmor.d/abstractions/opencl-common' +maybe chmod 0644 'apparmor.d/abstractions/opencl-intel' +maybe chmod 0644 'apparmor.d/abstractions/opencl-mesa' +maybe chmod 0644 'apparmor.d/abstractions/opencl-nvidia' +maybe chmod 0644 'apparmor.d/abstractions/opencl-pocl' maybe chmod 0644 'apparmor.d/abstractions/openssl' maybe chmod 0644 'apparmor.d/abstractions/orbit2' maybe chmod 0644 'apparmor.d/abstractions/p11-kit' @@ -523,6 +542,10 @@ maybe chmod 0644 'apparmor.d/abstractions/postfix-common' maybe chmod 0644 'apparmor.d/abstractions/private-files' maybe chmod 0644 'apparmor.d/abstractions/private-files-strict' maybe chmod 0644 'apparmor.d/abstractions/python' +maybe chmod 0644 'apparmor.d/abstractions/qt5' +maybe chmod 0644 'apparmor.d/abstractions/qt5-compose-cache-write' +maybe chmod 0644 'apparmor.d/abstractions/qt5-settings-write' +maybe chmod 0644 'apparmor.d/abstractions/recent-documents-write' maybe chmod 0644 'apparmor.d/abstractions/ruby' maybe chmod 0644 'apparmor.d/abstractions/samba' maybe chmod 0644 'apparmor.d/abstractions/smbpass' @@ -560,17 +583,19 @@ maybe chmod 0644 'apparmor.d/abstractions/user-manpages' maybe chmod 0644 'apparmor.d/abstractions/user-tmp' maybe chmod 0644 'apparmor.d/abstractions/user-write' maybe chmod 0644 'apparmor.d/abstractions/video' +maybe chmod 0644 'apparmor.d/abstractions/vulkan' maybe chmod 0644 'apparmor.d/abstractions/wayland' maybe chmod 0644 'apparmor.d/abstractions/web-data' maybe chmod 0644 'apparmor.d/abstractions/winbind' maybe chmod 0644 'apparmor.d/abstractions/wutmp' maybe chmod 0644 'apparmor.d/abstractions/xad' maybe chmod 0644 'apparmor.d/abstractions/xdg-desktop' -maybe chmod 0755 'apparmor.d/cache' maybe chmod 0755 'apparmor.d/disable' maybe chmod 0755 'apparmor.d/force-complain' maybe chmod 0755 'apparmor.d/local' maybe chmod 0644 'apparmor.d/local/README' +maybe chmod 0644 'apparmor.d/local/lsb_release' +maybe chmod 0644 'apparmor.d/local/nvidia_modprobe' maybe chmod 0644 'apparmor.d/local/sbin.dhclient' maybe chmod 0644 'apparmor.d/local/usr.bin.man' maybe chmod 0644 'apparmor.d/local/usr.lib.ipsec.charon' @@ -579,6 +604,8 @@ maybe chmod 0644 'apparmor.d/local/usr.sbin.mysqld' maybe chmod 0644 'apparmor.d/local/usr.sbin.named' maybe chmod 0644 'apparmor.d/local/usr.sbin.rsyslogd' maybe chmod 0644 'apparmor.d/local/usr.sbin.tcpdump' +maybe chmod 0644 'apparmor.d/lsb_release' +maybe chmod 0644 'apparmor.d/nvidia_modprobe' maybe chmod 0644 'apparmor.d/sbin.dhclient' maybe chmod 0755 'apparmor.d/tunables' maybe chmod 0644 'apparmor.d/tunables/alias' @@ -595,6 +622,7 @@ maybe chmod 0755 'apparmor.d/tunables/multiarch.d' maybe chmod 0644 'apparmor.d/tunables/multiarch.d/site.local' maybe chmod 0644 'apparmor.d/tunables/proc' maybe chmod 0644 'apparmor.d/tunables/securityfs' +maybe chmod 0644 'apparmor.d/tunables/share' maybe chmod 0644 'apparmor.d/tunables/sys' maybe chmod 0644 'apparmor.d/tunables/xdg-user-dirs' maybe chmod 0755 'apparmor.d/tunables/xdg-user-dirs.d' @@ -609,7 +637,6 @@ maybe chmod 0644 'apparmor.d/usr.sbin.tcpdump' maybe chmod 0755 'apparmor/init' maybe chmod 0755 'apparmor/init/network-interface-security' maybe chmod 0644 'apparmor/parser.conf' -maybe chmod 0644 'apparmor/subdomain.conf' maybe chmod 0755 'apt' maybe chmod 0755 'apt/apt.conf.d' maybe chmod 0644 'apt/apt.conf.d/00trustcdrom' @@ -637,12 +664,14 @@ maybe chmod 0755 'apt/trusted.gpg.d' maybe chmod 0644 'apt/trusted.gpg.d/ubuntu-keyring-2012-archive.gpg' maybe chmod 0644 'apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg' maybe chmod 0644 'apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg' +maybe chmod 0755 'avahi' +maybe chmod 0755 'avahi/services' +maybe chmod 0644 'avahi/services/phpmyadmin.service' maybe chmod 0644 'bash.bashrc' maybe chmod 0644 'bash_completion' maybe chmod 0755 'bash_completion.d' maybe chmod 0644 'bash_completion.d/fail2ban' maybe chmod 0644 'bash_completion.d/git-prompt' -maybe chmod 0644 'bash_completion.d/grub' maybe chown 'bind' 'bind' maybe chgrp 'bind' 'bind' maybe chmod 2775 'bind' @@ -748,6 +777,7 @@ maybe chmod 0755 'cron.d' maybe chmod 0644 'cron.d/.placeholder' maybe chmod 0644 'cron.d/amavisd-new' maybe chmod 0644 'cron.d/certbot' +maybe chmod 0644 'cron.d/e2scrub_all' maybe chmod 0644 'cron.d/loolwsd' maybe chmod 0644 'cron.d/php' maybe chmod 0644 'cron.d/popularity-contest' @@ -765,10 +795,8 @@ maybe chmod 0755 'cron.daily/etckeeper' maybe chmod 0755 'cron.daily/logrotate' maybe chmod 0755 'cron.daily/man-db' maybe chmod 0755 'cron.daily/mlocate' -maybe chmod 0755 'cron.daily/passwd' maybe chmod 0755 'cron.daily/popularity-contest' maybe chmod 0755 'cron.daily/spamassassin' -maybe chmod 0755 'cron.daily/ubuntu-advantage-tools' maybe chmod 0755 'cron.hourly' maybe chmod 0644 'cron.hourly/.placeholder' maybe chmod 0755 'cron.monthly' @@ -782,6 +810,7 @@ maybe chmod 0755 'cruft/filters-unex' maybe chmod 0644 'cruft/filters-unex/etckeeper' maybe chmod 0755 'dbconfig-common' maybe chmod 0600 'dbconfig-common/config' +maybe chmod 0600 'dbconfig-common/opendmarc.conf' maybe chmod 0600 'dbconfig-common/phpmyadmin.conf' maybe chmod 0755 'dbus-1' maybe chmod 0755 'dbus-1/session.d' @@ -808,19 +837,21 @@ maybe chmod 0644 'default/dbus' maybe chmod 0644 'default/dovecot' maybe chmod 0644 'default/fail2ban' maybe chmod 0644 'default/grub' +maybe chmod 0755 'default/grub.d' +maybe chmod 0644 'default/grub.d/init-select.cfg' maybe chmod 0644 'default/intel-microcode' maybe chmod 0644 'default/irqbalance' maybe chmod 0644 'default/keyboard' maybe chmod 0644 'default/knockd' maybe chmod 0644 'default/locale' maybe chmod 0644 'default/motd-news' +maybe chmod 0644 'default/named' maybe chmod 0644 'default/networkd-dispatcher' maybe chmod 0644 'default/nss' maybe chmod 0644 'default/opendkim' maybe chmod 0644 'default/opendmarc' maybe chmod 0644 'default/redis-server' maybe chmod 0644 'default/rsync' -maybe chmod 0644 'default/rsyslog' maybe chmod 0644 'default/spamassassin' maybe chmod 0644 'default/ssh' maybe chmod 0644 'default/ufw' @@ -854,11 +885,10 @@ maybe chmod 0755 'dpkg/origins' maybe chmod 0644 'dpkg/origins/debian' maybe chmod 0644 'dpkg/origins/ubuntu' maybe chmod 0644 'drirc' +maybe chmod 0644 'e2scrub.conf' maybe chmod 0755 'emacs' maybe chmod 0755 'emacs/site-start.d' -maybe chmod 0644 'emacs/site-start.d/00debian-vars.el' maybe chmod 0644 'emacs/site-start.d/50dictionaries-common.el' -maybe chmod 0644 'emacs/site-start.el' maybe chmod 0644 'environment' maybe chmod 0755 'etckeeper' maybe chmod 0755 'etckeeper/commit.d' @@ -908,6 +938,7 @@ maybe chmod 0755 'etckeeper/update-ignore.d/01update-ignore' maybe chmod 0644 'etckeeper/update-ignore.d/README' maybe chmod 0755 'etckeeper/vcs.d' maybe chmod 0755 'etckeeper/vcs.d/50vcs-cmd' +maybe chmod 0644 'ethertypes' maybe chmod 0755 'fail2ban' maybe chmod 0755 'fail2ban/action.d' maybe chmod 0644 'fail2ban/action.d/abuseipdb.conf' @@ -952,6 +983,7 @@ maybe chmod 0644 'fail2ban/action.d/netscaler.conf' maybe chmod 0644 'fail2ban/action.d/nftables-allports.conf' maybe chmod 0644 'fail2ban/action.d/nftables-common.conf' maybe chmod 0644 'fail2ban/action.d/nftables-multiport.conf' +maybe chmod 0644 'fail2ban/action.d/nftables.conf' maybe chmod 0644 'fail2ban/action.d/nginx-block-map.conf' maybe chmod 0644 'fail2ban/action.d/npf.conf' maybe chmod 0644 'fail2ban/action.d/nsupdate.conf' @@ -991,7 +1023,9 @@ maybe chmod 0644 'fail2ban/filter.d/apache-pass.conf' maybe chmod 0644 'fail2ban/filter.d/apache-shellshock.conf' maybe chmod 0644 'fail2ban/filter.d/assp.conf' maybe chmod 0644 'fail2ban/filter.d/asterisk.conf' +maybe chmod 0644 'fail2ban/filter.d/bitwarden.conf' maybe chmod 0644 'fail2ban/filter.d/botsearch-common.conf' +maybe chmod 0644 'fail2ban/filter.d/centreon.conf' maybe chmod 0644 'fail2ban/filter.d/common.conf' maybe chmod 0644 'fail2ban/filter.d/counter-strike.conf' maybe chmod 0644 'fail2ban/filter.d/courier-auth.conf' @@ -1057,11 +1091,13 @@ maybe chmod 0644 'fail2ban/filter.d/sshd.conf' maybe chmod 0644 'fail2ban/filter.d/stunnel.conf' maybe chmod 0644 'fail2ban/filter.d/suhosin.conf' maybe chmod 0644 'fail2ban/filter.d/tine20.conf' +maybe chmod 0644 'fail2ban/filter.d/traefik-auth.conf' maybe chmod 0644 'fail2ban/filter.d/uwimap-auth.conf' maybe chmod 0644 'fail2ban/filter.d/vsftpd.conf' maybe chmod 0644 'fail2ban/filter.d/webmin-auth.conf' maybe chmod 0644 'fail2ban/filter.d/wuftpd.conf' maybe chmod 0644 'fail2ban/filter.d/xinetd-fail.conf' +maybe chmod 0644 'fail2ban/filter.d/znc-adminlog.conf' maybe chmod 0644 'fail2ban/filter.d/zoneminder.conf' maybe chmod 0644 'fail2ban/ip.blacklist' maybe chmod 0644 'fail2ban/jail.conf' @@ -1150,6 +1186,7 @@ maybe chmod 0755 'grub.d' maybe chmod 0755 'grub.d/00_header' maybe chmod 0755 'grub.d/05_debian_theme' maybe chmod 0755 'grub.d/10_linux' +maybe chmod 0755 'grub.d/10_linux_zfs' maybe chmod 0755 'grub.d/20_linux_xen' maybe chmod 0755 'grub.d/30_os-prober' maybe chmod 0755 'grub.d/30_uefi-firmware' @@ -1178,7 +1215,6 @@ maybe chmod 0755 'init.d/amavisd-snmp-subagent' maybe chmod 0755 'init.d/apache-htcacheclean' maybe chmod 0755 'init.d/apache2' maybe chmod 0755 'init.d/apparmor' -maybe chmod 0755 'init.d/bind9' maybe chmod 0755 'init.d/console-setup.sh' maybe chmod 0755 'init.d/cron' maybe chmod 0755 'init.d/dbus' @@ -1192,6 +1228,7 @@ maybe chmod 0755 'init.d/keyboard-setup.sh' maybe chmod 0755 'init.d/kmod' maybe chmod 0755 'init.d/knockd' maybe chmod 0755 'init.d/mysql' +maybe chmod 0755 'init.d/named' maybe chmod 0755 'init.d/opendkim' maybe chmod 0755 'init.d/opendmarc' maybe chmod 0755 'init.d/plymouth' @@ -5605,15 +5642,18 @@ maybe chmod 0644 'locale.gen' maybe chmod 0755 'logcheck' maybe chmod 0755 'logcheck/ignore.d.paranoid' maybe chmod 0644 'logcheck/ignore.d.paranoid/mysql-server-5_7' +maybe chmod 0644 'logcheck/ignore.d.paranoid/mysql-server-8_0' maybe chmod 0755 'logcheck/ignore.d.server' maybe chmod 0644 'logcheck/ignore.d.server/gpg-agent' maybe chmod 0644 'logcheck/ignore.d.server/libsasl2-modules' maybe chmod 0644 'logcheck/ignore.d.server/mysql-server-5_7' +maybe chmod 0644 'logcheck/ignore.d.server/mysql-server-8_0' maybe chmod 0644 'logcheck/ignore.d.server/postfix-policyd-spf-python' maybe chmod 0644 'logcheck/ignore.d.server/razor' maybe chmod 0644 'logcheck/ignore.d.server/rsyslog' maybe chmod 0755 'logcheck/ignore.d.workstation' maybe chmod 0644 'logcheck/ignore.d.workstation/mysql-server-5_7' +maybe chmod 0644 'logcheck/ignore.d.workstation/mysql-server-8_0' maybe chmod 0755 'logcheck/violations.ignore.d' maybe chmod 0644 'login.defs' maybe chmod 0644 'logrotate.conf' @@ -5621,6 +5661,8 @@ maybe chmod 0755 'logrotate.d' maybe chmod 0644 'logrotate.d/alternatives' maybe chmod 0644 'logrotate.d/apache2' maybe chmod 0644 'logrotate.d/apt' +maybe chmod 0644 'logrotate.d/bootlog' +maybe chmod 0644 'logrotate.d/btmp' maybe chmod 0644 'logrotate.d/certbot' maybe chmod 0644 'logrotate.d/dbconfig-common' maybe chmod 0644 'logrotate.d/dpkg' @@ -5630,7 +5672,9 @@ maybe chmod 0644 'logrotate.d/razor' maybe chmod 0644 'logrotate.d/redis-server' maybe chmod 0644 'logrotate.d/rsnapshot' maybe chmod 0644 'logrotate.d/rsyslog' +maybe chmod 0644 'logrotate.d/ubuntu-advantage-tools' maybe chmod 0644 'logrotate.d/ufw' +maybe chmod 0644 'logrotate.d/wtmp' maybe chmod 0755 'loolwsd' maybe chmod 0644 'loolwsd/cert.pem' maybe chmod 0644 'loolwsd/chain.pem' @@ -5655,6 +5699,7 @@ maybe chmod 0644 'mailcap' maybe chmod 0644 'mailcap.order' maybe chmod 0644 'mailname' maybe chmod 0644 'manpath.config' +maybe chmod 0644 'mecabrc' maybe chmod 0644 'mime.types' maybe chmod 0644 'mke2fs.conf' maybe chmod 0755 'modprobe.d' @@ -5681,6 +5726,7 @@ maybe chmod 0600 'mysql/debian.cnf' maybe chmod 0644 'mysql/my.cnf.fallback' maybe chmod 0644 'mysql/mysql.cnf' maybe chmod 0755 'mysql/mysql.conf.d' +maybe chmod 0644 'mysql/mysql.conf.d/mysql.cnf' maybe chmod 0644 'mysql/mysql.conf.d/mysqld.cnf' maybe chmod 0644 'mysql/mysql.conf.d/mysqld_safe_syslog.cnf' maybe chmod 0755 'myssl' @@ -5694,10 +5740,11 @@ maybe chmod 0755 'network/if-down.d/bind9' maybe chmod 0755 'network/if-down.d/postfix' maybe chmod 0755 'network/if-up.d' maybe chmod 0755 'network/if-up.d/bind9' -maybe chmod 0755 'network/if-up.d/openssh-server' maybe chmod 0755 'network/if-up.d/postfix' maybe chmod 0644 'network/interfaces' maybe chmod 0755 'networkd-dispatcher' +maybe chmod 0755 'networkd-dispatcher/carrier.d' +maybe chmod 0755 'networkd-dispatcher/degraded.d' maybe chmod 0755 'networkd-dispatcher/dormant.d' maybe chmod 0755 'networkd-dispatcher/no-carrier.d' maybe chmod 0755 'networkd-dispatcher/off.d' @@ -5749,13 +5796,13 @@ maybe chmod 0644 'pam.d/runuser' maybe chmod 0644 'pam.d/runuser-l' maybe chmod 0644 'pam.d/sshd' maybe chmod 0644 'pam.d/su' +maybe chmod 0644 'pam.d/su-l' maybe chmod 0644 'pam.d/sudo' maybe chmod 0644 'pam.d/systemd-user' maybe chmod 0664 'pam.d/webmin' maybe chmod 0644 'passwd' maybe chmod 0644 'passwd-' maybe chmod 0755 'perl' -maybe chmod 0755 'perl/CPAN' maybe chmod 0755 'perl/Net' maybe chmod 0644 'perl/Net/libnet.cfg' maybe chmod 0755 'php' @@ -5778,11 +5825,9 @@ maybe chmod 0644 'php/7.2/mods-available/ftp.ini' maybe chmod 0644 'php/7.2/mods-available/gd.ini' maybe chmod 0644 'php/7.2/mods-available/gettext.ini' maybe chmod 0644 'php/7.2/mods-available/iconv.ini' -maybe chmod 0644 'php/7.2/mods-available/igbinary.ini' maybe chmod 0644 'php/7.2/mods-available/intl.ini' maybe chmod 0644 'php/7.2/mods-available/json.ini' maybe chmod 0644 'php/7.2/mods-available/mbstring.ini' -maybe chmod 0644 'php/7.2/mods-available/memcache.ini' maybe chmod 0644 'php/7.2/mods-available/mysqli.ini' maybe chmod 0644 'php/7.2/mods-available/mysqlnd.ini' maybe chmod 0644 'php/7.2/mods-available/opcache.ini' @@ -5791,7 +5836,6 @@ maybe chmod 0644 'php/7.2/mods-available/pdo_mysql.ini' maybe chmod 0644 'php/7.2/mods-available/phar.ini' maybe chmod 0644 'php/7.2/mods-available/posix.ini' maybe chmod 0644 'php/7.2/mods-available/readline.ini' -maybe chmod 0644 'php/7.2/mods-available/redis.ini' maybe chmod 0644 'php/7.2/mods-available/shmop.ini' maybe chmod 0644 'php/7.2/mods-available/simplexml.ini' maybe chmod 0644 'php/7.2/mods-available/sockets.ini' @@ -5805,6 +5849,54 @@ maybe chmod 0644 'php/7.2/mods-available/xmlreader.ini' maybe chmod 0644 'php/7.2/mods-available/xmlwriter.ini' maybe chmod 0644 'php/7.2/mods-available/xsl.ini' maybe chmod 0644 'php/7.2/mods-available/zip.ini' +maybe chmod 0755 'php/7.4' +maybe chmod 0755 'php/7.4/apache2' +maybe chmod 0755 'php/7.4/apache2/conf.d' +maybe chmod 0644 'php/7.4/apache2/php.ini' +maybe chmod 0755 'php/7.4/cli' +maybe chmod 0755 'php/7.4/cli/conf.d' +maybe chmod 0644 'php/7.4/cli/php.ini' +maybe chmod 0755 'php/7.4/mods-available' +maybe chmod 0644 'php/7.4/mods-available/bz2.ini' +maybe chmod 0644 'php/7.4/mods-available/calendar.ini' +maybe chmod 0644 'php/7.4/mods-available/ctype.ini' +maybe chmod 0644 'php/7.4/mods-available/curl.ini' +maybe chmod 0644 'php/7.4/mods-available/dom.ini' +maybe chmod 0644 'php/7.4/mods-available/exif.ini' +maybe chmod 0644 'php/7.4/mods-available/ffi.ini' +maybe chmod 0644 'php/7.4/mods-available/fileinfo.ini' +maybe chmod 0644 'php/7.4/mods-available/ftp.ini' +maybe chmod 0644 'php/7.4/mods-available/gd.ini' +maybe chmod 0644 'php/7.4/mods-available/gettext.ini' +maybe chmod 0644 'php/7.4/mods-available/iconv.ini' +maybe chmod 0644 'php/7.4/mods-available/igbinary.ini' +maybe chmod 0644 'php/7.4/mods-available/json.ini' +maybe chmod 0644 'php/7.4/mods-available/mbstring.ini' +maybe chmod 0644 'php/7.4/mods-available/memcache.ini' +maybe chmod 0644 'php/7.4/mods-available/mysqli.ini' +maybe chmod 0644 'php/7.4/mods-available/mysqlnd.ini' +maybe chmod 0644 'php/7.4/mods-available/opcache.ini' +maybe chmod 0644 'php/7.4/mods-available/pdo.ini' +maybe chmod 0644 'php/7.4/mods-available/pdo_mysql.ini' +maybe chmod 0644 'php/7.4/mods-available/phar.ini' +maybe chmod 0644 'php/7.4/mods-available/posix.ini' +maybe chmod 0644 'php/7.4/mods-available/readline.ini' +maybe chmod 0644 'php/7.4/mods-available/redis.ini' +maybe chmod 0644 'php/7.4/mods-available/shmop.ini' +maybe chmod 0644 'php/7.4/mods-available/simplexml.ini' +maybe chmod 0644 'php/7.4/mods-available/sockets.ini' +maybe chmod 0644 'php/7.4/mods-available/sysvmsg.ini' +maybe chmod 0644 'php/7.4/mods-available/sysvsem.ini' +maybe chmod 0644 'php/7.4/mods-available/sysvshm.ini' +maybe chmod 0644 'php/7.4/mods-available/tokenizer.ini' +maybe chmod 0644 'php/7.4/mods-available/xml.ini' +maybe chmod 0644 'php/7.4/mods-available/xmlreader.ini' +maybe chmod 0644 'php/7.4/mods-available/xmlwriter.ini' +maybe chmod 0644 'php/7.4/mods-available/xsl.ini' +maybe chmod 0644 'php/7.4/mods-available/zip.ini' +maybe chmod 0755 'php/7.4/phpdbg' +maybe chmod 0755 'php/7.4/phpdbg/conf.d' +maybe chmod 0644 'php/7.4/phpdbg/php.ini' maybe chmod 0755 'phpmyadmin' maybe chmod 0644 'phpmyadmin/apache.conf' maybe chmod 0755 'phpmyadmin/conf.d' @@ -5831,7 +5923,6 @@ maybe chmod 0755 'postfix/dynamicmaps.cf.d' maybe chmod 0644 'postfix/main.cf' maybe chmod 0644 'postfix/main.cf.proto' maybe chmod 0644 'postfix/main.cf.save' -maybe chmod 0644 'postfix/makedefs.out' maybe chmod 0644 'postfix/master.cf' maybe chmod 0644 'postfix/master.cf.proto' maybe chmod 0644 'postfix/master.cf.save' @@ -5874,6 +5965,8 @@ maybe chmod 0644 'python2.7/sitecustomize.py' maybe chmod 0755 'python3' maybe chmod 0755 'python3.6' maybe chmod 0644 'python3.6/sitecustomize.py' +maybe chmod 0755 'python3.8' +maybe chmod 0644 'python3.8/sitecustomize.py' maybe chmod 0644 'python3/debian_config' maybe chmod 0755 'razor' maybe chmod 0644 'razor/razor-agent.conf' @@ -5892,7 +5985,6 @@ maybe chmod 0640 'redis/redis.conf' maybe chmod 0755 'resolvconf' maybe chmod 0755 'resolvconf/update-libc.d' maybe chmod 0755 'resolvconf/update-libc.d/postfix' -maybe chmod 0755 'rmt' maybe chmod 0644 'rpc' maybe chmod 0644 'rsnapshot.conf' maybe chmod 0644 'rsyslog.conf' @@ -5901,7 +5993,6 @@ maybe chmod 0644 'rsyslog.d/20-ufw.conf' maybe chmod 0644 'rsyslog.d/50-default.conf' maybe chmod 0644 'rsyslog.d/postfix.conf' maybe chmod 0644 'screenrc' -maybe chmod 0644 'securetty' maybe chmod 0755 'security' maybe chmod 0644 'security/access.conf' maybe chmod 0644 'security/capability.conf' @@ -5948,9 +6039,11 @@ maybe chmod 0644 'spamassassin/v330.pre' maybe chmod 0644 'spamassassin/v340.pre' maybe chmod 0644 'spamassassin/v341.pre' maybe chmod 0644 'spamassassin/v342.pre' +maybe chmod 0644 'spamassassin/v343.pre' maybe chmod 0755 'ssh' maybe chmod 0644 'ssh/moduli' maybe chmod 0644 'ssh/ssh_config' +maybe chmod 0755 'ssh/ssh_config.d' maybe chmod 0600 'ssh/ssh_host_ecdsa_key' maybe chmod 0644 'ssh/ssh_host_ecdsa_key.pub' maybe chmod 0600 'ssh/ssh_host_ed25519_key' @@ -5959,6 +6052,7 @@ maybe chmod 0600 'ssh/ssh_host_rsa_key' maybe chmod 0644 'ssh/ssh_host_rsa_key.pub' maybe chmod 0644 'ssh/ssh_import_id' maybe chmod 0644 'ssh/sshd_config' +maybe chmod 0755 'ssh/sshd_config.d' maybe chmod 0755 'ssl' maybe chmod 0755 'ssl/certs' maybe chmod 0644 'ssl/certs/ca-certificates.crt' @@ -5982,6 +6076,7 @@ maybe chmod 0644 'strongswan.d/charon/connmark.conf' maybe chmod 0644 'strongswan.d/charon/constraints.conf' maybe chmod 0644 'strongswan.d/charon/counters.conf' maybe chmod 0644 'strongswan.d/charon/dnskey.conf' +maybe chmod 0644 'strongswan.d/charon/drbg.conf' maybe chmod 0644 'strongswan.d/charon/eap-mschapv2.conf' maybe chmod 0644 'strongswan.d/charon/fips-prf.conf' maybe chmod 0644 'strongswan.d/charon/gcm.conf' @@ -6027,24 +6122,29 @@ maybe chmod 0755 'sysctl.d' maybe chmod 0644 'sysctl.d/10-console-messages.conf' maybe chmod 0644 'sysctl.d/10-ipv6-privacy.conf' maybe chmod 0644 'sysctl.d/10-kernel-hardening.conf' -maybe chmod 0644 'sysctl.d/10-link-restrictions.conf' maybe chmod 0644 'sysctl.d/10-magic-sysrq.conf' maybe chmod 0644 'sysctl.d/10-network-security.conf' maybe chmod 0644 'sysctl.d/10-ptrace.conf' maybe chmod 0644 'sysctl.d/10-zeropage.conf' maybe chmod 0644 'sysctl.d/README' +maybe chmod 0644 'sysctl.d/README.sysctl' maybe chmod 0755 'systemd' maybe chmod 0644 'systemd/journald.conf' maybe chmod 0644 'systemd/logind.conf' maybe chmod 0755 'systemd/network' +maybe chmod 0644 'systemd/networkd.conf' +maybe chmod 0644 'systemd/pstore.conf' maybe chmod 0644 'systemd/resolved.conf' +maybe chmod 0644 'systemd/sleep.conf' maybe chmod 0755 'systemd/system' maybe chmod 0644 'systemd/system.conf' maybe chmod 0755 'systemd/system/default.target.wants' +maybe chmod 0755 'systemd/system/emergency.target.wants' maybe chmod 0755 'systemd/system/getty.target.wants' maybe chmod 0755 'systemd/system/graphical.target.wants' maybe chmod 0755 'systemd/system/multi-user.target.wants' maybe chmod 0755 'systemd/system/paths.target.wants' +maybe chmod 0755 'systemd/system/rescue.target.wants' maybe chmod 0664 'systemd/system/set-route-network.service' maybe chmod 0755 'systemd/system/sockets.target.wants' maybe chmod 0755 'systemd/system/sysinit.target.wants' @@ -6052,11 +6152,14 @@ maybe chmod 0755 'systemd/system/timers.target.wants' maybe chmod 0644 'systemd/timesyncd.conf' maybe chmod 0755 'systemd/user' maybe chmod 0644 'systemd/user.conf' +maybe chmod 0755 'systemd/user/sockets.target.wants' maybe chmod 0755 'terminfo' maybe chmod 0644 'terminfo/README' maybe chmod 0644 'timezone' maybe chmod 0755 'tmpfiles.d' maybe chmod 0644 'tmpfiles.d/screen-cleanup.conf' +maybe chmod 0755 'ubuntu-advantage' +maybe chmod 0644 'ubuntu-advantage/uaclient.conf' maybe chmod 0644 'ucf.conf' maybe chmod 0755 'udev' maybe chmod 0755 'udev/hwdb.d' @@ -6087,13 +6190,15 @@ maybe chmod 0755 'update-motd.d' maybe chmod 0755 'update-motd.d/00-header' maybe chmod 0755 'update-motd.d/10-help-text' maybe chmod 0755 'update-motd.d/50-motd-news' -maybe chmod 0755 'update-motd.d/80-esm' -maybe chmod 0755 'update-motd.d/80-livepatch' maybe chmod 0755 'update-motd.d/91-release-upgrade' maybe chmod 0644 'updatedb.conf' maybe chmod 0755 'vim' maybe chmod 0644 'vim/vimrc' maybe chmod 0644 'vim/vimrc.tiny' +maybe chmod 0755 'vulkan' +maybe chmod 0755 'vulkan/explicit_layer.d' +maybe chmod 0755 'vulkan/icd.d' +maybe chmod 0755 'vulkan/implicit_layer.d' maybe chmod 0755 'webmin' maybe chgrp 'bin' 'webmin/acl' maybe chmod 0711 'webmin/acl' @@ -6593,6 +6698,7 @@ maybe chmod 0711 'webmin/xinetd' maybe chgrp 'bin' 'webmin/xinetd/config' maybe chmod 0600 'webmin/xinetd/config' maybe chmod 0644 'wgetrc' +maybe chmod 0644 'xattr.conf' maybe chmod 0755 'xdg' maybe chmod 0755 'xdg/autostart' maybe chmod 0644 'xdg/autostart/xdg-user-dirs.desktop' diff --git a/Muttrc b/Muttrc index b0ce970e3..ac289d9fd 100644 --- a/Muttrc +++ b/Muttrc @@ -54,7 +54,9 @@ macro index,pager,attach,compose \cb "\ macro generic,pager " zcat /usr/share/doc/mutt/manual.txt.gz | sensible-pager" "show Mutt documentation" # show the incoming mailboxes list (just like "mutt -y") and back when pressing "y" -macro index,pager y "?" "show incoming mailboxes list" +# note: these macros have been subsumed by the function. +# macro index y "?" "show incoming mailboxes list" +# macro pager y "?" "show incoming mailboxes list" bind browser y exit # Handler for gzip compressed mailboxes diff --git a/Muttrc.d/gpg.rc b/Muttrc.d/gpg.rc index 614e7f5dd..70e7bcc0f 100644 --- a/Muttrc.d/gpg.rc +++ b/Muttrc.d/gpg.rc @@ -1,11 +1,9 @@ # -*-muttrc-*- # # Command formats for gpg. -# -# This version uses gpg-2comp from -# http://70t.de/download/gpg-2comp.tar.gz # -# $Id$ +# Some of the older commented-out versions of the commands use gpg-2comp from: +# http://70t.de/download/gpg-2comp.tar.gz # # %p The empty string when no passphrase is needed, # the string "PGPPASSFD=0" if one is needed. @@ -20,12 +18,36 @@ # file's name. # # %a In "signing" contexts, this expands to the value of the -# configuration variable $pgp_sign_as. You probably need to +# configuration variable $pgp_sign_as, if set, otherwise +# $pgp_default_key. You probably need to # use this within a conditional % sequence. # # %r In many contexts, mutt passes key IDs to pgp. %r expands to # a list of key IDs. + +# Section A: Key Management + +# The default key for encryption (used by $pgp_self_encrypt and +# $postpone_encrypt). +# +# It will also be used for signing unless $pgp_sign_as is set to a +# key. +# +# Unless your key does not have encryption capability, uncomment this +# line and replace the keyid with your own. +# +# set pgp_default_key="0x12345678" + +# If you have a separate signing key, or your key _only_ has signing +# capability, uncomment this line and replace the keyid with your +# signing keyid. +# +# set pgp_sign_as="0x87654321" + + +# Section B: Commands + # Note that we explicitly set the comment armor header since GnuPG, when used # in some localiaztion environments, generates 8bit data in that header, thereby # breaking PGP/MIME. @@ -71,9 +93,11 @@ set pgp_export_command="gpg --no-verbose --export --armor %r" set pgp_verify_key_command="gpg --verbose --batch --fingerprint --check-sigs %r" # read in the public key ring +# note: the second --with-fingerprint adds fingerprints to subkeys set pgp_list_pubring_command="gpg --no-verbose --batch --quiet --with-colons --with-fingerprint --with-fingerprint --list-keys %r" # read in the secret key ring +# note: the second --with-fingerprint adds fingerprints to subkeys set pgp_list_secring_command="gpg --no-verbose --batch --quiet --with-colons --with-fingerprint --with-fingerprint --list-secret-keys %r" # fetch keys @@ -90,5 +114,7 @@ set pgp_list_secring_command="gpg --no-verbose --batch --quiet --with-colons --w set pgp_good_sign="^\\[GNUPG:\\] GOODSIG" # pattern to verify a decryption occurred -set pgp_decryption_okay="^\\[GNUPG:\\] DECRYPTION_OKAY" +# This is now deprecated by pgp_check_gpg_decrypt_status_fd: +# set pgp_decryption_okay="^\\[GNUPG:\\] DECRYPTION_OKAY" +set pgp_check_gpg_decrypt_status_fd diff --git a/Muttrc.d/smime.rc b/Muttrc.d/smime.rc index 238c8c419..2c3fd0ad0 100644 --- a/Muttrc.d/smime.rc +++ b/Muttrc.d/smime.rc @@ -19,11 +19,28 @@ #set crypt_replysignencrypted = yes #set crypt_verify_sig = yes -# Section A: Key Management. -# The (default) keyfile for signing/decrypting. Uncomment the following +# Section A: Key Management + +# The default keyfile for encryption (used by $smime_self_encrypt and +# $postpone_encrypt). +# +# It will also be used for decryption unless +# $smime_decrypt_use_default_key is unset. +# +# It will additionally be used for signing unless $smime_sign_as is +# set to a key. +# +# Unless your key does not have encryption capability, uncomment this # line and replace the keyid with your own. -#set smime_default_key="12345678.0" +# +# set smime_default_key="12345678.0" + +# If you have a separate signing key, or your key _only_ has signing +# capability, uncomment this line and replace the keyid with your +# signing keyid. +# +# set smime_sign_as="87654321.0" # Uncomment to make mutt ask what key to use when trying to decrypt a message. # It will use the default key above (if that was set) else. @@ -57,7 +74,7 @@ set smime_import_cert_command="smime_keys add_cert %f" -# Sction B: Outgoing messages +# Section B: Outgoing messages # Algorithm to use for encryption. # valid choices are aes128, aes192, aes256, rc2-40, rc2-64, rc2-128, des, des3 @@ -75,7 +92,7 @@ set smime_sign_command="openssl smime -sign -md %d -signer %c -inkey %k -passin -#Section C: Incoming messages +# Section C: Incoming messages # Decrypt a message. Output is a MIME entity. set smime_decrypt_command="openssl cms -decrypt -passin stdin -inform DER -in %f -inkey %k -recip %c" diff --git a/aide/aide.conf.d/31_aide_amanda-server b/aide/aide.conf.d/31_aide_amanda-server index 385430d21..9a826da34 100755 --- a/aide/aide.conf.d/31_aide_amanda-server +++ b/aide/aide.conf.d/31_aide_amanda-server @@ -119,4 +119,3 @@ cat < + SetHandler application/x-httpd-php + + + SetHandler application/x-httpd-php-source + # Deny access to raw php sources by default + # To re-enable it's recommended to enable access to the files + # only in specific virtual host or directory + Require all denied + +# Deny access to files without filename (e.g. '.php') + + Require all denied + + +# Running PHP scripts in user directories is disabled by default +# +# To re-enable PHP in user directories comment the following lines +# (from to .) Do NOT set it to On as it +# prevents .htaccess files from disabling it. + + + php_admin_flag engine Off + + diff --git a/apache2/mods-available/php7.4.load b/apache2/mods-available/php7.4.load new file mode 100644 index 000000000..94935a436 --- /dev/null +++ b/apache2/mods-available/php7.4.load @@ -0,0 +1,3 @@ +# Conflicts: php5 +# Depends: mpm_prefork +LoadModule php7_module /usr/lib/apache2/modules/libphp7.4.so diff --git a/apache2/mods-enabled/php7.2.conf b/apache2/mods-enabled/php7.2.conf deleted file mode 120000 index 8d6058a54..000000000 --- a/apache2/mods-enabled/php7.2.conf +++ /dev/null @@ -1 +0,0 @@ -../mods-available/php7.2.conf \ No newline at end of file diff --git a/apache2/mods-enabled/php7.2.load b/apache2/mods-enabled/php7.2.load deleted file mode 120000 index 66b235bc8..000000000 --- a/apache2/mods-enabled/php7.2.load +++ /dev/null @@ -1 +0,0 @@ -../mods-available/php7.2.load \ No newline at end of file diff --git a/apache2/mods-enabled/php7.4.conf b/apache2/mods-enabled/php7.4.conf new file mode 120000 index 000000000..7170bada2 --- /dev/null +++ b/apache2/mods-enabled/php7.4.conf @@ -0,0 +1 @@ +../mods-available/php7.4.conf \ No newline at end of file diff --git a/apache2/mods-enabled/php7.4.load b/apache2/mods-enabled/php7.4.load new file mode 120000 index 000000000..e223ffc2f --- /dev/null +++ b/apache2/mods-enabled/php7.4.load @@ -0,0 +1 @@ +../mods-available/php7.4.load \ No newline at end of file diff --git a/apm/event.d/20hdparm b/apm/event.d/20hdparm deleted file mode 100755 index 951d869b5..000000000 --- a/apm/event.d/20hdparm +++ /dev/null @@ -1,82 +0,0 @@ -#!/bin/sh - -# Copyright (c) 2000-2002 Massachusetts Institute of Technology -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or (at -# your option) any later version. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA -# 02111-1307, USA. - -set -e - -# The APMD_DRIVES setting specifies the drives to be changed. Set -# this to an empty string to disable any changes. -#APMD_DRIVES= - -# The spindown timeout is set to the value of APMD_SPINDOWN when the -# computer is running on battery power. When the computer is on AC -# power, the spindown timeout is disabled. The number specified here -# is encoded in a complicated way. See the man page for hdparm(8) for -# details. For small timeouts, numbers between 1 and 240 specify -# multiples of 5 seconds. So the default value of 18 means 18*5=90 -# seconds, or 1.5 minutes. -APMD_SPINDOWN=18 - -HDPARM=/sbin/hdparm -[ -x "${HDPARM}" ] || exit 0 - -[ -n "${APMD_DRIVES}" ] || exit 0 - -for DRIVE in $APMD_DRIVES; do - [ -b "${DRIVE}" ] || exit 0 -done - -[ "${APMD_SPINDOWN}" -gt 0 ] || exit 0 - -power_conserve () -{ - # Set IDE hard disk spindown time to a short time. - for DRIVE in $APMD_DRIVES; do - "${HDPARM}" -q -S "${APMD_SPINDOWN}" "${DRIVE}" || true - done -} - -power_performance () -{ - # Disable IDE hard disk spindown. - for DRIVE in $APMD_DRIVES; do - "${HDPARM}" -q -S 0 "${DRIVE}" || true - done -} - -choose_power () -{ - if on_ac_power > /dev/null - then - power_performance - else - power_conserve - fi -} - -if [ "${1}" = "start" ]; then - choose_power -elif [ "${1}" = "resume" ] && [ "${2}" != "standby" ]; then - choose_power -elif [ "${1},${2}" = "change,power" ]; then - choose_power -elif [ "${1}" = "stop" ]; then - power_performance -fi - -exit 0 diff --git a/apparmor.d/abstractions/X b/apparmor.d/abstractions/X index ced3c6ba9..db3521e7a 100644 --- a/apparmor.d/abstractions/X +++ b/apparmor.d/abstractions/X @@ -10,6 +10,7 @@ # # ------------------------------------------------------------------ + #include # .ICEauthority files required for X authentication, per user @@ -45,17 +46,12 @@ # EGL /usr/lib/@{multiarch}/egl/*.so* mr, - # DRI - /usr/lib{,32,64}/dri/** mr, - /usr/lib/@{multiarch}/dri/** mr, - /usr/lib/fglrx/dri/** mr, - /dev/dri/** rw, - /etc/drirc r, - owner @{HOME}/.drirc r, - # Xcompose owner @{HOME}/.XCompose r, # mouse themes /etc/X11/cursors/ r, /etc/X11/cursors/** r, + + # Xwayland + owner /run/user/*/.mutter-Xwaylandauth.* r, diff --git a/apparmor.d/abstractions/apache2-common b/apparmor.d/abstractions/apache2-common index 3088c0362..850dd89c8 100644 --- a/apparmor.d/abstractions/apache2-common +++ b/apparmor.d/abstractions/apache2-common @@ -7,9 +7,9 @@ # Allow unconfined processes to send us signals by default signal (receive) peer=unconfined, # Allow apache to send us signals by default - signal (receive) peer=/usr/sbin/apache2, + signal (receive) peer=apache2, # Allow other hats to signal by default - signal peer=/usr/sbin/apache2//*, + signal peer=apache2//*, # Allow us to signal ourselves signal peer=@{profile_name}, diff --git a/apparmor.d/abstractions/apparmor_api/is_enabled b/apparmor.d/abstractions/apparmor_api/is_enabled index a69310e13..a637d3ced 100644 --- a/apparmor.d/abstractions/apparmor_api/is_enabled +++ b/apparmor.d/abstractions/apparmor_api/is_enabled @@ -8,8 +8,8 @@ # permissions needed for aa_is_enabled -# Make sure to include at least tunables/sys and tunables/apparmorfs -# when using this abstraction, if not tunables/global. +# Make sure to include tunables/apparmorfs and tunables/global +# when using this abstraction #include @{sys}/module/apparmor/parameters/enabled r, diff --git a/apparmor.d/abstractions/audio b/apparmor.d/abstractions/audio index 960083a1d..f4dbaac30 100644 --- a/apparmor.d/abstractions/audio +++ b/apparmor.d/abstractions/audio @@ -41,9 +41,14 @@ /usr/share/sounds/** r, owner @{HOME}/.esd_auth r, +/etc/asound.conf r, owner @{HOME}/.asoundrc r, /etc/esound/esd.conf r, +# libao +/etc/libao.conf r, +owner @{HOME}/.libao r, + # libcanberra owner @{HOME}/.cache/event-sound-cache.* rwk, @@ -68,6 +73,7 @@ owner /tmp/pulse-*/* rw, /etc/sound/** r, # openal +/etc/alsa/conf.d/{,*} r, /etc/openal/alsoft.conf r, owner @{HOME}/.alsoftrc r, /usr/{,local/}share/openal/hrtf/{,**} r, diff --git a/apparmor.d/abstractions/base b/apparmor.d/abstractions/base index ee19e1b97..1dc77a30d 100644 --- a/apparmor.d/abstractions/base +++ b/apparmor.d/abstractions/base @@ -23,6 +23,10 @@ /dev/log w, /dev/random r, /dev/urandom r, + # Allow access to the uuidd daemon (this daemon is a thin wrapper around + # time and getrandom()/{,u}random and, when available, runs under an + # unprivilged, dedicated user). + /run/uuidd/request r, /etc/locale/** r, /etc/locale.alias r, /etc/localtime r, @@ -65,13 +69,11 @@ # we might as well allow everything to use common libraries /{usr/,}lib{,32,64}/** r, - /{usr/,}lib{,32,64}/lib*.so* mr, - /{usr/,}lib{,32,64}/**/lib*.so* mr, + /{usr/,}lib{,32,64}/**.so* mr, /{usr/,}lib/@{multiarch}/** r, - /{usr/,}lib/@{multiarch}/lib*.so* mr, - /{usr/,}lib/@{multiarch}/**/lib*.so* mr, - /{usr/,}lib/tls/i686/{cmov,nosegneg}/lib*.so* mr, - /{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/lib*.so* mr, + /{usr/,}lib/@{multiarch}/**.so* mr, + /{usr/,}lib/tls/i686/{cmov,nosegneg}/*.so* mr, + /{usr/,}lib/i386-linux-gnu/tls/i686/{cmov,nosegneg}/*.so* mr, # /dev/null is pretty harmless and frequently used /dev/null rw, @@ -91,8 +93,8 @@ @{PROC}/meminfo r, @{PROC}/stat r, @{PROC}/cpuinfo r, - /sys/devices/system/cpu/ r, - /sys/devices/system/cpu/online r, + @{sys}/devices/system/cpu/ r, + @{sys}/devices/system/cpu/online r, # glibc's *printf protections read the maps file @{PROC}/@{pid}/{maps,auxv,status} r, @@ -158,7 +160,9 @@ # prevents access to the files from processes running under a different uid. # encrypted ~/.Private and old-style encrypted $HOME + owner @{HOME}/.Private/ r, owner @{HOME}/.Private/** mrixwlk, # new-style encrypted $HOME + owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r, owner @{HOMEDIRS}/.ecryptfs/*/.Private/** mrixwlk, diff --git a/apparmor.d/abstractions/dovecot-common b/apparmor.d/abstractions/dovecot-common index 327cc567d..e1681d9a0 100644 --- a/apparmor.d/abstractions/dovecot-common +++ b/apparmor.d/abstractions/dovecot-common @@ -14,6 +14,6 @@ deny capability block_suspend, # dovecot's master can send us signals - signal receive peer=/usr/sbin/dovecot, + signal receive peer=dovecot, /{var/,}run/dovecot/config rw, diff --git a/apparmor.d/abstractions/dri-common b/apparmor.d/abstractions/dri-common new file mode 100644 index 000000000..b5e0a5c5b --- /dev/null +++ b/apparmor.d/abstractions/dri-common @@ -0,0 +1,14 @@ +# vim:syntax=apparmor + +# This file contains common DRI-specific rules useful for GUI applications +# (needed by libdrm and similar). + + /usr/lib{,32,64}/dri/** mr, + /usr/lib/@{multiarch}/dri/** mr, + /usr/lib/fglrx/dri/** mr, + /dev/dri/ r, + /dev/dri/** rw, + /etc/drirc r, + /usr/share/drirc.d/{,*.conf} r, + owner @{HOME}/.drirc r, + diff --git a/apparmor.d/abstractions/dri-enumerate b/apparmor.d/abstractions/dri-enumerate new file mode 100644 index 000000000..e101be5cb --- /dev/null +++ b/apparmor.d/abstractions/dri-enumerate @@ -0,0 +1,8 @@ +# vim:syntax=apparmor + +# This file contains common DRI-specific rules useful for GUI applications that +# needs to enumerate graphic devices (as with drmParsePciDeviceInfo() from +# libdrm). + + @{sys}/devices/pci[0-9]*/**/{device,subsystem_device,subsystem_vendor,uevent,vendor} r, + diff --git a/apparmor.d/abstractions/fonts b/apparmor.d/abstractions/fonts index 45cdf9af6..222aa5a61 100644 --- a/apparmor.d/abstractions/fonts +++ b/apparmor.d/abstractions/fonts @@ -18,7 +18,9 @@ /usr/share/fonts/** r, /etc/fonts/** r, - /usr/share/fontconfig/conf.avail/** r, + # Debian, openSUSE paths are different + /usr/share/{fontconfig,fonts-config,*-fonts}/conf.avail/{,**} r, + /usr/share/ghostscript/fonts/{,**} r, /opt/kde3/share/fonts/** r, @@ -42,7 +44,7 @@ owner @{HOME}/.local/share/fonts/ r, owner @{HOME}/.local/share/fonts/** r, owner @{HOME}/.fonts.cache-2 mr, - owner @{HOME}/.{,cache/}fontconfig/ r, + owner @{HOME}/.{,cache/}fontconfig/ rw, owner @{HOME}/.{,cache/}fontconfig/** mrl, owner @{HOME}/.fonts.conf.d/ r, owner @{HOME}/.fonts.conf.d/** r, diff --git a/apparmor.d/abstractions/freedesktop.org b/apparmor.d/abstractions/freedesktop.org index cc0c343c3..4ec174597 100644 --- a/apparmor.d/abstractions/freedesktop.org +++ b/apparmor.d/abstractions/freedesktop.org @@ -10,29 +10,20 @@ # ------------------------------------------------------------------ # system configuration - /{usr,usr/local,var/lib/flatpak/exports}/share/applications/{*/,} r, - /{usr,usr/local,var/lib/flatpak/exports}/share/applications/{*/,}defaults.list r, - /{usr,usr/local,var/lib/flatpak/exports}/share/applications/{*/,}mimeinfo.cache r, - /var/lib/snapd/desktop/applications/mimeinfo.cache r, - /{usr,usr/local,var/lib/flatpak/exports}/share/applications/{*/,}*.desktop r, - /var/lib/snapd/desktop/applications/{,*.desktop} r, - /usr/share/icons/ r, - /usr/share/icons/** r, - /usr/share/pixmaps/ r, - /usr/share/pixmaps/** r, - /usr/local/share/icons/ r, - /usr/local/share/icons/** r, - /usr/local/share/pixmaps/ r, - /usr/local/share/pixmaps/** r, - /var/lib/flatpak/exports/share/icons/ r, - /var/lib/flatpak/exports/share/icons/** r, + @{system_share_dirs}/applications/{**,} r, + @{system_share_dirs}/icons/{**,} r, + @{system_share_dirs}/pixmaps/{**,} r, # communitheme snap /snap/communitheme/*/share/icons/ r, /snap/communitheme/*/share/icons/** r, + # mimeinfo and desktop files for snaps + /var/lib/snapd/desktop/applications/mimeinfo.cache r, + /var/lib/snapd/desktop/applications/{,*.desktop} r, + # this should probably go elsewhere - /{usr,var/lib/flatpak/exports}/share/mime/** r, + @{system_share_dirs}/mime/** r, # per-user configurations owner @{HOME}/.icons/ r, @@ -40,12 +31,6 @@ owner @{HOME}/.local/share/recently-used.xbel* rw, owner @{HOME}/.config/user-dirs.dirs r, owner @{HOME}/.config/mimeapps.list r, - owner @{HOME}/.local/share/{,flatpak/exports/share/}applications/ r, - owner @{HOME}/.local/share/{,flatpak/exports/share/}applications/*.desktop r, - owner @{HOME}/.local/share/{,flatpak/exports/share/}applications/defaults.list r, - owner @{HOME}/.local/share/{,flatpak/exports/share/}applications/mimeapps.list r, - owner @{HOME}/.local/share/{,flatpak/exports/share/}applications/mimeinfo.cache r, - owner @{HOME}/.local/share/{,flatpak/exports/share/}icons/ r, - owner @{HOME}/.local/share/{,flatpak/exports/share/}icons/** r, - owner @{HOME}/.local/share/{,flatpak/exports/share/}mime/ r, - owner @{HOME}/.local/share/{,flatpak/exports/share/}mime/** r, + owner @{user_share_dirs}/applications/{**,} r, + owner @{user_share_dirs}/icons/{**,} r, + owner @{user_share_dirs}/mime/{**,} r, diff --git a/apparmor.d/abstractions/gnome b/apparmor.d/abstractions/gnome index 82d9ec453..a0459c308 100644 --- a/apparmor.d/abstractions/gnome +++ b/apparmor.d/abstractions/gnome @@ -46,6 +46,7 @@ /usr/lib/@{multiarch}/gdk-pixbuf-*/** mr, # per-user gtk configuration + owner @{HOME}/.config/gtk-3.0/ w, owner @{HOME}/.config/gtk-3.0/* r, owner @{HOME}/.gnome/Gnome r, owner @{HOME}/.gtk r, @@ -54,8 +55,11 @@ owner @{HOME}/.gtk-bookmarks r, owner @{HOME}/.themes/ r, owner @{HOME}/.themes/** r, + owner @{user_share_dirs}/themes/ r, + owner @{user_share_dirs}/themes/** r, # for gtk file dialog + owner @{HOME}/.config/gtk-2.0/ w, owner @{HOME}/.config/gtk-2.0/** r, owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw, @@ -66,6 +70,9 @@ # per-user font business owner @{HOME}/.fonts.cache-* rwl, + # GtkComposeTable + owner @{HOME}/.cache/gtk-3.0/** r, + # icon caches /var/cache/**/icon-theme.cache r, /usr/share/**/icon-theme.cache r, @@ -95,7 +102,7 @@ # mime-types /etc/gnome/defaults.list r, - /etc/xdg/*-mimeapps.list r, + /etc/xdg/{,*-}mimeapps.list r, /usr/share/gnome/applications/ r, /usr/share/gnome/applications/mimeinfo.cache r, diff --git a/apparmor.d/abstractions/ibus b/apparmor.d/abstractions/ibus index 0ab02fea1..a4431b99a 100644 --- a/apparmor.d/abstractions/ibus +++ b/apparmor.d/abstractions/ibus @@ -14,6 +14,16 @@ owner @{HOME}/.config/ibus/bus/ rw, owner @{HOME}/.config/ibus/bus/* rw, + # abstract path in ibus < 1.5.22 uses /tmp unix (connect, receive, send) type=stream peer=(addr="@/tmp/ibus/dbus-*"), + + # abstract path in ibus >= 1.5.22 uses $XDG_CACHE_HOME (ie, @{HOME}/.cache) + # This should use this, but due to LP: #1856738 we cannot + #unix (connect, receive, send) + # type=stream + # peer=(addr="@@{HOME}/.cache/ibus/dbus-*"), + unix (connect, receive, send) + type=stream + peer=(addr="@/home/*/.cache/ibus/dbus-*"), diff --git a/apparmor.d/abstractions/kde b/apparmor.d/abstractions/kde index 49efa6a74..cad5c7db0 100644 --- a/apparmor.d/abstractions/kde +++ b/apparmor.d/abstractions/kde @@ -15,6 +15,7 @@ #include #include #include +#include /etc/qt3/kstylerc r, /etc/qt3/qt_plugins_3.3rc r, @@ -22,7 +23,10 @@ /etc/kderc r, /etc/kde3/* r, /etc/kde4rc r, +/etc/xdg/kdeglobals r, /etc/xdg/Trolltech.conf r, +/usr/share/knotifications5/*.notifyrc r, # KNotification::sendEvent() +/usr/share/kubuntu-default-settings/kf5-settings/* r, owner @{HOME}/.DCOPserver_* r, owner @{HOME}/.ICEauthority r, @@ -30,10 +34,15 @@ owner @{HOME}/.fonts.* lrw, owner @{HOME}/.kde{,4}/share/config/kdeglobals rw, owner @{HOME}/.kde{,4}/share/config/*.lock rwl, owner @{HOME}/.qt/** rw, +owner @{HOME}/.cache/ksycoca5_??_* r, # KDE System Configuration Cache owner @{HOME}/.config/Trolltech.conf rwk, +owner @{HOME}/.config/baloofilerc r, # indexing options (excludes, etc), used by KFileWidget +owner @{HOME}/.config/dolphinrc r, # settings used by KFileWidget +owner @{HOME}/.config/kde.org/libphonon.conf r, # for KNotifications::sendEvent() +owner @{HOME}/.config/kdeglobals r, # global settings, used by Breeze style, etc. +owner @{HOME}/.config/klanguageoverridesrc r, # per-application languages, for KDEPrivate::initializeLanguages() from libKF5XmlGui.so +owner @{HOME}/.config/trashrc r, # Used by KFileWidget -/usr/share/icons/ r, -/usr/share/icons/** r, /usr/share/X11/XKeysymDB r, # kde3 diff --git a/apparmor.d/abstractions/kde-globals-write b/apparmor.d/abstractions/kde-globals-write new file mode 100644 index 000000000..5f878e845 --- /dev/null +++ b/apparmor.d/abstractions/kde-globals-write @@ -0,0 +1,10 @@ +# vim:syntax=apparmor +# Rules for changing KDE settings (for KFileDialog and other). + + # User files + + owner @{HOME}/.config/#[0-9]* rw, + owner @{HOME}/.config/kdeglobals rw, + owner @{HOME}/.config/kdeglobals.?????? rwl -> @{HOME}/.config/#[0-9]*, + owner @{HOME}/.config/kdeglobals.lock rwk, + diff --git a/apparmor.d/abstractions/kde-icon-cache-write b/apparmor.d/abstractions/kde-icon-cache-write new file mode 100644 index 000000000..d37fb3b8e --- /dev/null +++ b/apparmor.d/abstractions/kde-icon-cache-write @@ -0,0 +1,7 @@ +# vim:syntax=apparmor +# Rules for writing KDE icon cache + + # User files + + owner @{HOME}/.cache/icon-cache.kcache rw, # for KIconLoader + diff --git a/apparmor.d/abstractions/kde-language-write b/apparmor.d/abstractions/kde-language-write new file mode 100644 index 000000000..8e9539929 --- /dev/null +++ b/apparmor.d/abstractions/kde-language-write @@ -0,0 +1,12 @@ +# vim:syntax=apparmor +# Rules for changing per-application language settings on KDE. Some KDE +# applications have "Help -> Switch Application Language..." option, that needs +# write access to language settings file. + + # User files + + owner @{HOME}/.config/#[0-9]* rw, + owner @{HOME}/.config/klanguageoverridesrc rw, + owner @{HOME}/.config/klanguageoverridesrc.?????? rwl -> @{HOME}/.config/#[0-9]*, + owner @{HOME}/.config/klanguageoverridesrc.lock rwk, + diff --git a/apparmor.d/abstractions/kerberosclient b/apparmor.d/abstractions/kerberosclient index eab762a2f..5b79e3d6b 100644 --- a/apparmor.d/abstractions/kerberosclient +++ b/apparmor.d/abstractions/kerberosclient @@ -22,6 +22,8 @@ /etc/krb5.keytab rk, /etc/krb5.conf r, + /etc/krb5.conf.d/ r, + /etc/krb5.conf.d/* r, # config files found via strings on libs /etc/krb.conf r, diff --git a/apparmor.d/abstractions/launchpad-integration b/apparmor.d/abstractions/launchpad-integration deleted file mode 100644 index 1f833cefa..000000000 --- a/apparmor.d/abstractions/launchpad-integration +++ /dev/null @@ -1,28 +0,0 @@ -# vim:syntax=apparmor -# launchpad-integration - - # Launchpad integration should run in a sanitizing profile - /usr/bin/launchpad-integration Cxr -> launchpad_integration, - profile launchpad_integration { - #include - #include - #include - - # Required for debuggers - capability sys_ptrace, - - # Run confined with security execution. sudo scrubs the environment, so we - # don't have to - /usr/bin/sudo Ux, - - # Give it wide permissions since it and apport need to do a lot - /** rwlk, - /{,usr/}{,s}bin/* Pixr, - /{,usr/}lib*/{,**/}*.so{,.*} m, - /usr/share/apport/* Pixr, - - # Dangerous files - audit deny owner /**/*.py* r, # python imports - audit deny owner /**/* m, # compiled libraries - } - diff --git a/apparmor.d/abstractions/ldapclient b/apparmor.d/abstractions/ldapclient index e3922ca6b..0c527282f 100644 --- a/apparmor.d/abstractions/ldapclient +++ b/apparmor.d/abstractions/ldapclient @@ -18,4 +18,7 @@ /etc/sasl2/* r, /usr/lib{,32,64}/sasl2/* r, + # local LDAP name service daemon + /{,var/}run/nslcd/socket rw, + #include diff --git a/apparmor.d/abstractions/mdns b/apparmor.d/abstractions/mdns index e05ef3a45..14c31b8c5 100644 --- a/apparmor.d/abstractions/mdns +++ b/apparmor.d/abstractions/mdns @@ -9,5 +9,6 @@ # ------------------------------------------------------------------ # mdnsd + /etc/mdns.allow r, /etc/nss_mdns.conf r, /{,var/}run/mdnsd w, diff --git a/apparmor.d/abstractions/mesa b/apparmor.d/abstractions/mesa new file mode 100644 index 000000000..be699c774 --- /dev/null +++ b/apparmor.d/abstractions/mesa @@ -0,0 +1,17 @@ +# vim:syntax=apparmor +# Rules for Mesa implementation of the OpenGL API + + # System files + /dev/dri/ r, # libGLX_mesa.so calls drmGetDevice2() + + # Needed to check if the kernel supports the i915 perf interface + # (src/intel/perf/gen_perf.c, load_oa_metrics()) + @{PROC}/sys/dev/i915/perf_stream_paranoid r, + + # User files + owner @{HOME}/.cache/ w, # if user clears all caches + owner @{HOME}/.cache/mesa_shader_cache/ w, + owner @{HOME}/.cache/mesa_shader_cache/index rw, + owner @{HOME}/.cache/mesa_shader_cache/??/ w, + owner @{HOME}/.cache/mesa_shader_cache/??/* rwk, + diff --git a/apparmor.d/abstractions/nameservice b/apparmor.d/abstractions/nameservice index 6e678fb04..357eaa8b6 100644 --- a/apparmor.d/abstractions/nameservice +++ b/apparmor.d/abstractions/nameservice @@ -29,6 +29,11 @@ /var/lib/extrausers/group r, /var/lib/extrausers/passwd r, + # NSS records from systemd-userdbd.service + /{,var/}run/systemd/userdb/ r, + /{,var/}run/systemd/userdb/io.systemd.{NameServiceSwitch,Multiplexer,DynamicUser,Home} r, + @{PROC}/sys/kernel/random/boot_id r, + # When using sssd, the passwd and group files are stored in an alternate path # and the nss plugin also needs to talk to a pipe /var/lib/sss/mc/group r, @@ -39,7 +44,7 @@ /etc/resolv.conf r, # On systems where /etc/resolv.conf is managed programmatically, it is # a symlink to /{,var/}run/(whatever program is managing it)/resolv.conf. - /{,var/}run/{resolvconf,NetworkManager,systemd/resolve,connman}/resolv.conf r, + /{,var/}run/{resolvconf,NetworkManager,systemd/resolve,connman,netconfig}/resolv.conf r, /etc/resolvconf/run/resolv.conf r, /{,var/}run/systemd/resolve/stub-resolv.conf r, @@ -106,6 +111,29 @@ member="Resolve{Address,Hostname,Record,Service}" peer=(name="org.freedesktop.resolve1"), + # libnss-systemd + # + # https://systemd.io/USER_GROUP_API/ + # https://systemd.io/USER_RECORD/ + # https://www.freedesktop.org/software/systemd/man/nss-systemd.html + # + # Allow User/Group lookups via common VarLink socket APIs. Applications need + # to either consult all of them or the io.systemd.Multiplexer frontend. + /run/systemd/userdb/ r, + /run/systemd/userdb/io.systemd.Multiplexer rw, + /run/systemd/userdb/io.systemd.DynamicUser rw, # systemd-exec users + /run/systemd/userdb/io.systemd.Home rw, # systemd-home dirs + /run/systemd/userdb/io.systemd.NameServiceSwitch rw, # UNIX/glibc NSS + + # Also allow lookups for systemd-exec's DynamicUsers via D-Bus + # https://www.freedesktop.org/software/systemd/man/systemd.exec.html + dbus send + bus=system + path="/org/freedesktop/systemd1" + interface="org.freedesktop.systemd1.Manager" + member="{GetDynamicUsers,LookupDynamicUserByName,LookupDynamicUserByUID}" + peer=(name="org.freedesktop.systemd1"), + # TCP/UDP network access network inet stream, network inet6 stream, diff --git a/apparmor.d/abstractions/nvidia b/apparmor.d/abstractions/nvidia index 5e182a653..b01ef8b55 100644 --- a/apparmor.d/abstractions/nvidia +++ b/apparmor.d/abstractions/nvidia @@ -4,6 +4,8 @@ # configuration queries capability ipc_lock, + /usr/share/nvidia/nvidia-application-profiles* r, + # libvdpau config file for nvidia workarounds /etc/vdpau_wrapper.cfg r, @@ -17,7 +19,10 @@ @{PROC}/driver/nvidia/params r, @{PROC}/modules r, - owner @{HOME}/.nv/GLCache/ r, + @{sys}/devices/system/memory/block_size_bytes r, + + owner @{HOME}/.nv/ w, + owner @{HOME}/.nv/GLCache/ rw, owner @{HOME}/.nv/GLCache/** rwk, unix (send, receive) type=dgram peer=(addr="@nvidia[0-9a-f]*"), diff --git a/apparmor.d/abstractions/opencl b/apparmor.d/abstractions/opencl new file mode 100644 index 000000000..32a21b2a5 --- /dev/null +++ b/apparmor.d/abstractions/opencl @@ -0,0 +1,9 @@ +# vim:syntax=apparmor +# OpenCL access requirements + + # TODO: use conditionals to select allowed implementations + #include + #include + #include + #include + diff --git a/apparmor.d/abstractions/opencl-common b/apparmor.d/abstractions/opencl-common new file mode 100644 index 000000000..0ad3d559a --- /dev/null +++ b/apparmor.d/abstractions/opencl-common @@ -0,0 +1,10 @@ +# vim:syntax=apparmor +# implementation-independent OpenCL access requirements + + # System files + + /etc/OpenCL/** r, + @{sys}/bus/pci/devices/ r, # libpocl.so -> libhwlock.so, libnvidia-opencl.so, beignet/libcl.so -> libdrm_intel.so + @{sys}/devices/system/node/ r, # for clGetPlatformIDs() from libOpenCL.so + @{sys}/devices/system/node/node[0-9]*/meminfo r, # for clGetPlatformIDs() from libOpenCL.so + diff --git a/apparmor.d/abstractions/opencl-intel b/apparmor.d/abstractions/opencl-intel new file mode 100644 index 000000000..353eeca29 --- /dev/null +++ b/apparmor.d/abstractions/opencl-intel @@ -0,0 +1,17 @@ +# vim:syntax=apparmor +# OpenCL access requirements for Intel implementation + + #include + + # for libcl.so (libOpenCL.so -> beignet/libcl.so calls XOpenDisplay()) + #include + + # for libOpenCL.so -> beignet/libcl.so -> libpciaccess.so + #include + + # System files + + /dev/dri/card[0-9]* rw, # beignet/libcl.so + @{sys}/devices/pci[0-9]*/**/{class,config,resource,revision} r, # libcl.so -> libdrm_intel.so -> libpciaccess.so (move to dri-enumerate ?) + /usr/lib/@{multiarch}/beignet/** r, + diff --git a/apparmor.d/abstractions/opencl-mesa b/apparmor.d/abstractions/opencl-mesa new file mode 100644 index 000000000..9d7f82b27 --- /dev/null +++ b/apparmor.d/abstractions/opencl-mesa @@ -0,0 +1,20 @@ +# vim:syntax=apparmor +# OpenCL access requirements for Mesa implementation + + #include + + # Additional libraries + + /usr/lib/@{multiarch}/gallium-pipe/*.so mr, # libMesaOpenCL.so + /usr/lib{,64}/gallium-pipe/*.so mr, # libMesaOpenCL.so on openSUSE + + # System files + + /dev/dri/ r, # libMesaOpenCL.so -> libdrm.so + /dev/dri/render* rw, # libMesaOpenCL.so + /etc/drirc r, # libMesaOpenCL.so + + # User files + + owner @{HOME}/.cache/mesa_shader_cache/{,**} rw, # libMesaOpenCL.so -> pipe_nouveau.so + diff --git a/apparmor.d/abstractions/opencl-nvidia b/apparmor.d/abstractions/opencl-nvidia new file mode 100644 index 000000000..8a4764ecb --- /dev/null +++ b/apparmor.d/abstractions/opencl-nvidia @@ -0,0 +1,30 @@ +# vim:syntax=apparmor +# OpenCL access requirements for NVIDIA implementation + + #include + #include + + # Executables + + # https://github.com/NVIDIA/nvidia-modprobe + # This setuid executable is used to create various device files and load the + # the nvidia kernel module. + /usr/bin/nvidia-modprobe Px -> nvidia_modprobe, + + # System files + + # libnvidia-opencl.so rules: + /dev/nvidia-uvm rw, + /dev/nvidia-uvm-tools rw, + @{sys}/devices/pci[0-9]*/**/config r, + @{sys}/devices/system/memory/block_size_bytes r, + /usr/share/nvidia/** r, + @{PROC}/devices r, + @{PROC}/sys/vm/mmap_min_addr r, + + # User files + + owner @{HOME}/.nv/ComputeCache/ w, + owner @{HOME}/.nv/ComputeCache/** rw, + owner @{HOME}/.nv/ComputeCache/index rwk, + diff --git a/apparmor.d/abstractions/opencl-pocl b/apparmor.d/abstractions/opencl-pocl new file mode 100644 index 000000000..054689abc --- /dev/null +++ b/apparmor.d/abstractions/opencl-pocl @@ -0,0 +1,76 @@ +# vim:syntax=apparmor +# OpenCL access requirements for POCL implementation + + #include + + # Executables + + /usr/bin/{,@{multiarch}-}ld.bfd Cx -> opencl_pocl_ld, + /usr/lib/llvm-[0-9]*.[0-9]*/bin/clang Cx -> opencl_pocl_clang, + + # System files + + / r, # libpocl.so -> libhwloc.so + @{sys}/bus/pci/slots/ r, # libpocl.so -> hwloc_topology_load() from libhwloc.so + @{sys}/bus/{cpu,node}/devices/ r, # libpocl.so -> libhwlock.so + @{sys}/class/net/ r, # libpocl.so -> hwloc_pci_traverse_lookuposdevices_cb() from libhwloc.so + @{sys}/devices/pci[0-9]*/**/ r, # for libpocl -> hwloc_linux_lookup_block_class() from libhwloc.so + @{sys}/devices/pci[0-9]*/**/block/*/dev r, # libpocl.so -> hwloc_linux_lookup_host_block_class() from libhwloc.so + @{sys}/devices/pci[0-9]*/**/{class,local_cpus} r, # libpocl.so -> libhwlock.so + @{sys}/devices/pci[0-9]*/*/net/*/address r, # libpocl.so -> hwloc_pci_traverse_lookuposdevices_cb() from libhwloc.so + @{sys}/devices/system/cpu/ r, # libpocl.so -> libnuma.so + @{sys}/devices/system/cpu/cpu[0-9]*/cache/index[0-9]*/* r, # libpocl.so -> libhwloc.so + @{sys}/devices/system/cpu/cpu[0-9]*/online r, # libpocl.so -> libhwlock.so + @{sys}/devices/system/cpu/cpu[0-9]*/topology/* r, # *_siblings, physical_package_id and lot's of others, for libpocl.so -> libhwloc.so + @{sys}/devices/system/cpu/cpufreq/policy[0-9]*/* r, # for clGetPlatformIDs() from libpocl.so + @{sys}/devices/system/cpu/possible r, # libpocl.so -> libhwloc.so + @{sys}/devices/virtual/dmi/id/{,*} r, # libpocl.so -> libhwloc.so + @{sys}/fs/cgroup/cpuset/cpuset.{cpus,mems} r, # libpocl.so -> libhwloc.so + @{sys}/kernel/mm/hugepages{/,/**} r, # libpocl.so -> libhwloc.so + /usr/share/pocl/** r, + /{,var/}run/udev/data/*:* r, # libpocl.so -> hwloc_linux_block_class_fillinfos() from libhwloc.so + + # User files + + owner @{HOME}/.cache/pocl/ w, + owner @{HOME}/.cache/pocl/kcache/ w, + owner @{HOME}/.cache/pocl/kcache/** rw, + owner @{HOME}/.cache/pocl/kcache/**.so mrw, # dangerous! + owner @{PROC}/@{pid}/{cgroup,cpuset,status} r, # libpocl.so -> libhwloc.so, status for libpocl.so -> libnuma.so + + # Child profiles + + profile opencl_pocl_ld { + #include + + # Main executables + + /usr/bin/{,@{multiarch}-}ld.bfd mr, + + # User files + + owner @{HOME}/.cache/pocl/kcache/tempfile*.so rw, + owner @{HOME}/.cache/pocl/kcache/**.so.o r, + } + + profile opencl_pocl_clang { + #include + + # Main executables + + /usr/lib/llvm-[0-9]*.[0-9]*/bin/clang mr, + + # Additional executables + + /usr/bin/{,@{multiarch}-}ld.bfd ix, # TODO: transfer to opencl_ld child profile? + + # System files + + /etc/debian-version r, + /etc/lsb-release r, + + # User files + + owner @{HOME}/.cache/pocl/kcache/*/*/*/*/*.so{,.o} rw, + } + diff --git a/apparmor.d/abstractions/php b/apparmor.d/abstractions/php index 91b31205b..4aba2415c 100644 --- a/apparmor.d/abstractions/php +++ b/apparmor.d/abstractions/php @@ -19,6 +19,9 @@ # php extensions /usr/lib{64,}/php{,5,7}/*/*.so mr, + # ICU (unicode support) data tables + /usr/share/icu/*/*.dat r, + # php session mmap socket /var/lib/php{,5,7}/session_mm_* rwlk, # file based session handler diff --git a/apparmor.d/abstractions/postfix-common b/apparmor.d/abstractions/postfix-common index 86e38880e..3dc599afe 100644 --- a/apparmor.d/abstractions/postfix-common +++ b/apparmor.d/abstractions/postfix-common @@ -17,8 +17,10 @@ # postfix's master can send us signals signal receive peer=/usr/lib/postfix/master, + signal receive peer=postfix-master, unix (send, receive) peer=(label=/usr/lib/postfix/master), + unix (send, receive) peer=(label=postfix-master), /etc/mailname r, /etc/postfix/*.cf r, diff --git a/apparmor.d/abstractions/private-files b/apparmor.d/abstractions/private-files index 0a659f132..09f6d9bdc 100644 --- a/apparmor.d/abstractions/private-files +++ b/apparmor.d/abstractions/private-files @@ -6,6 +6,7 @@ # lot of false positives when reading contents of directories) deny @{HOME}/.*history mrwkl, deny @{HOME}/.fetchmail* mrwkl, + deny @{HOME}/.mutt** mrwkl, deny @{HOME}/.viminfo* mrwkl, deny @{HOME}/.*~ mrwkl, deny @{HOME}/.*.swp mrwkl, diff --git a/apparmor.d/abstractions/private-files-strict b/apparmor.d/abstractions/private-files-strict index 60ea72a06..31934318f 100644 --- a/apparmor.d/abstractions/private-files-strict +++ b/apparmor.d/abstractions/private-files-strict @@ -5,6 +5,7 @@ #include # potentially extremely sensitive files + audit deny @{HOME}/.aws/{,**} mrwkl, audit deny @{HOME}/.gnupg/{,**} mrwkl, audit deny @{HOME}/.ssh/{,**} mrwkl, audit deny @{HOME}/.gnome2_private/{,**} mrwkl, diff --git a/apparmor.d/abstractions/python b/apparmor.d/abstractions/python index 1e0f1b2a3..925161c11 100644 --- a/apparmor.d/abstractions/python +++ b/apparmor.d/abstractions/python @@ -10,28 +10,28 @@ # # ------------------------------------------------------------------ - /usr/lib{,32,64}/python{2.[4-7],3.[0-6]}/**.{pyc,so} mr, - /usr/lib{,32,64}/python{2.[4-7],3.[0-6]}/**.{egg,py,pth} r, - /usr/lib{,32,64}/python{2.[4-7],3.[0-6]}/{site,dist}-packages/ r, - /usr/lib{,32,64}/python3.[0-6]/lib-dynload/*.so mr, + /usr/lib{,32,64}/python{2.[4-7],3.[0-9]}/**.{pyc,so} mr, + /usr/lib{,32,64}/python{2.[4-7],3.[0-9]}/**.{egg,py,pth} r, + /usr/lib{,32,64}/python{2.[4-7],3.[0-9]}/{site,dist}-packages/ r, + /usr/lib{,32,64}/python3.[0-9]/lib-dynload/*.so mr, - /usr/local/lib{,32,64}/python{2.[4-7],3.[0-6]}/**.{pyc,so} mr, - /usr/local/lib{,32,64}/python{2.[4-7],3.[0-6]}/**.{egg,py,pth} r, - /usr/local/lib{,32,64}/python{2.[4-7],3.[0-6]}/{site,dist}-packages/ r, - /usr/local/lib{,32,64}/python3.[0-6]/lib-dynload/*.so mr, + /usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9]}/**.{pyc,so} mr, + /usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9]}/**.{egg,py,pth} r, + /usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9]}/{site,dist}-packages/ r, + /usr/local/lib{,32,64}/python3.[0-9]/lib-dynload/*.so mr, # Site-wide configuration - /etc/python{2.[4-7],3.[0-6]}/** r, + /etc/python{2.[4-7],3.[0-9]}/** r, # shared python paths /usr/share/{pyshared,pycentral,python-support}/** r, /{var,usr}/lib/{pyshared,pycentral,python-support}/** r, /usr/lib/{pyshared,pycentral,python-support}/**.so mr, /var/lib/{pyshared,pycentral,python-support}/**.pyc mr, - /usr/lib/python3/dist-packages/**.so mr, + /usr/lib/python3/dist-packages/**.so mr, # wx paths /usr/lib/wx/python/*.pth r, # python build configuration and headers - /usr/include/python{2.[4-7],3.[0-6]}*/pyconfig.h r, + /usr/include/python{2.[4-7],3.[0-9]}*/pyconfig.h r, diff --git a/apparmor.d/abstractions/qt5 b/apparmor.d/abstractions/qt5 new file mode 100644 index 000000000..66a574bf7 --- /dev/null +++ b/apparmor.d/abstractions/qt5 @@ -0,0 +1,22 @@ +# vim:syntax=apparmor +# Common rules for Qt5-based applications + + # Additional libraries + + /usr/lib{,64,/@{multiarch}}/qt5/plugins/**.so mr, + /usr/lib{,64,/@{multiarch}}/qt5/qml/**.so mr, + /usr/lib{,64,/@{multiarch}}/qt5/qml/**.{qmlc,jsc} mr, # Precompiled QML/JavaScript modules + + # System files + + /etc/xdg/QtProject/qtlogging.ini r, + /usr/share/qt5/translations/*.qm r, + /usr/lib{,64,/@{multiarch}}/qt5/plugins/** r, + /usr/lib{,64,/@{multiarch}}/qt5/qml/** r, + + # User files + + owner @{HOME}/.config/QtProject/qtlogging.ini r, + owner @{HOME}/.config/QtProject.conf r, # common settings for QFileDialog, etc (application might need write access) + owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* r, # for "platforminputcontexts" plugins + diff --git a/apparmor.d/abstractions/qt5-compose-cache-write b/apparmor.d/abstractions/qt5-compose-cache-write new file mode 100644 index 000000000..38cb23486 --- /dev/null +++ b/apparmor.d/abstractions/qt5-compose-cache-write @@ -0,0 +1,8 @@ +# vim:syntax=apparmor +# Allow writing cache for Qt5 "platforminputcontexts" plugins + + # User files + + owner @{HOME}/.cache/qt_compose_cache_{little,big}_endian_* rwl -> @{HOME}/.cache/#[0-9]*[0-9], + owner @{HOME}/.cache/#[0-9]*[0-9] rw, # QSaveFile (anonymous shared memory) + diff --git a/apparmor.d/abstractions/qt5-settings-write b/apparmor.d/abstractions/qt5-settings-write new file mode 100644 index 000000000..07d10972d --- /dev/null +++ b/apparmor.d/abstractions/qt5-settings-write @@ -0,0 +1,11 @@ +# vim:syntax=apparmor +# Allow writing shared settings for Qt-based applications + + # User files + + owner @{HOME}/.config/#[0-9]*[0-9] rw, + owner @{HOME}/.config/QtProject.conf rwl -> @{HOME}/.config/#[0-9]*[0-9], + # for temporary files like QtProject.conf.Aqrgeb + owner @{HOME}/.config/QtProject.conf.?????? rwl -> @{HOME}/.config/#[0-9]*[0-9], + owner @{HOME}/.config/QtProject.conf.lock rwk, + diff --git a/apparmor.d/abstractions/recent-documents-write b/apparmor.d/abstractions/recent-documents-write new file mode 100644 index 000000000..d95febb8f --- /dev/null +++ b/apparmor.d/abstractions/recent-documents-write @@ -0,0 +1,10 @@ +# vim:syntax=apparmor +# Allow updating recent documents + + # User files + + owner @{HOME}/.local/share/RecentDocuments/ rw, + owner @{HOME}/.local/share/RecentDocuments/#[0-9]* rw, + owner @{HOME}/.local/share/RecentDocuments/*.desktop rwl -> @{HOME}/.local/share/RecentDocuments/#[0-9]*, + owner @{HOME}/.local/share/RecentDocuments/*.lock rwk, + diff --git a/apparmor.d/abstractions/samba b/apparmor.d/abstractions/samba index b6cc4fa2c..1cab7309e 100644 --- a/apparmor.d/abstractions/samba +++ b/apparmor.d/abstractions/samba @@ -19,7 +19,7 @@ /var/lib/samba/** rwk, /var/log/samba/cores/ rw, /var/log/samba/cores/** rw, - /var/log/samba/log.* w, + /var/log/samba/* w, /{,var/}run/samba/ w, /{,var/}run/samba/*.tdb rw, diff --git a/apparmor.d/abstractions/ssl_certs b/apparmor.d/abstractions/ssl_certs index 0234fd4b9..b5382ec96 100644 --- a/apparmor.d/abstractions/ssl_certs +++ b/apparmor.d/abstractions/ssl_certs @@ -27,3 +27,14 @@ # acmetool /var/lib/acme/certs/*/chain r, /var/lib/acme/certs/*/cert r, + + # dehydrated + /{etc,var/lib}/dehydrated/certs/*/cert*.pem r, + /{etc,var/lib}/dehydrated/certs/*/chain*.pem r, + /{etc,var/lib}/dehydrated/certs/*/fullchain*.pem r, + /{etc,var/lib}/dehydrated/certs/*/ocsp*.der r, + + # certbot + /etc/letsencrypt/archive/*/cert*.pem r, + /etc/letsencrypt/archive/*/chain*.pem r, + /etc/letsencrypt/archive/*/fullchain*.pem r, diff --git a/apparmor.d/abstractions/ssl_keys b/apparmor.d/abstractions/ssl_keys index c6f29ad24..84f5c503d 100644 --- a/apparmor.d/abstractions/ssl_keys +++ b/apparmor.d/abstractions/ssl_keys @@ -20,3 +20,9 @@ /var/lib/acme/live/* r, /var/lib/acme/certs/** r, /var/lib/acme/keys/** r, + + # dehydrated + /{etc,var/lib}/dehydrated/certs/*/privkey*.pem r, + + # certbot / letsencrypt + /etc/letsencrypt/archive/*/privkey*.pem r, diff --git a/apparmor.d/abstractions/ubuntu-browsers b/apparmor.d/abstractions/ubuntu-browsers index 0d67682a8..d4438ad6a 100644 --- a/apparmor.d/abstractions/ubuntu-browsers +++ b/apparmor.d/abstractions/ubuntu-browsers @@ -25,12 +25,12 @@ /usr/bin/sensible-browser Pixr, /usr/bin/chromium{,-browser} Cx -> sanitized_helper, - /usr/lib/chromium{,-browser}/chromium{,-browser} Cx -> sanitized_helper, + /usr/lib{,64}/chromium{,-browser}/chromium{,-browser} Cx -> sanitized_helper, # this should cover all firefox browsers and versions (including shiretoko # and abrowser) /usr/bin/firefox Cxr -> sanitized_helper, - /usr/lib/firefox*/firefox* Cx -> sanitized_helper, + /usr/lib{,64}/firefox*/firefox* Cx -> sanitized_helper, # Iceweasel /usr/bin/iceweasel Cxr -> sanitized_helper, diff --git a/apparmor.d/abstractions/ubuntu-browsers.d/java b/apparmor.d/abstractions/ubuntu-browsers.d/java index 269bd528d..e0a67cf31 100644 --- a/apparmor.d/abstractions/ubuntu-browsers.d/java +++ b/apparmor.d/abstractions/ubuntu-browsers.d/java @@ -42,8 +42,8 @@ @{PROC}/@{pid}/ r, @{PROC}/@{pid}/fd/ r, @{PROC}/filesystems r, - /sys/devices/system/cpu/ r, - /sys/devices/system/cpu/** r, + @{sys}/devices/system/cpu/ r, + @{sys}/devices/system/cpu/** r, /usr/share/** r, /var/lib/dbus/machine-id r, @@ -90,8 +90,8 @@ @{PROC}/@{pid}/ r, @{PROC}/@{pid}/fd/ r, @{PROC}/filesystems r, - /sys/devices/system/cpu/ r, - /sys/devices/system/cpu/** r, + @{sys}/devices/system/cpu/ r, + @{sys}/devices/system/cpu/** r, /usr/share/** r, /var/lib/dbus/machine-id r, diff --git a/apparmor.d/abstractions/ubuntu-browsers.d/multimedia b/apparmor.d/abstractions/ubuntu-browsers.d/multimedia index 84fbbc85a..591d6b854 100644 --- a/apparmor.d/abstractions/ubuntu-browsers.d/multimedia +++ b/apparmor.d/abstractions/ubuntu-browsers.d/multimedia @@ -17,6 +17,9 @@ /usr/bin/gwenview Cxr -> sanitized_helper, #include + owner @{HOME}/.adobe/ w, + owner @{HOME}/.adobe/** rw, + owner @{HOME}/.macromedia/ w, owner @{HOME}/.macromedia/** rw, /opt/real/RealPlayer/mozilla/nphelix.so rm, /usr/bin/lpstat Cxr -> sanitized_helper, diff --git a/apparmor.d/abstractions/ubuntu-email b/apparmor.d/abstractions/ubuntu-email index 4c6812ac7..48e0c6f40 100644 --- a/apparmor.d/abstractions/ubuntu-email +++ b/apparmor.d/abstractions/ubuntu-email @@ -20,5 +20,5 @@ /usr/bin/sylpheed Cx -> sanitized_helper, /usr/bin/tkrat Cx -> sanitized_helper, + /usr/bin/thunderbird Cx -> sanitized_helper, # used by gio-launch-desktop /usr/lib/thunderbird*/thunderbird{,.sh,-bin} Cx -> sanitized_helper, - diff --git a/apparmor.d/abstractions/ubuntu-helpers b/apparmor.d/abstractions/ubuntu-helpers index 6e89c1464..a1ab7bc04 100644 --- a/apparmor.d/abstractions/ubuntu-helpers +++ b/apparmor.d/abstractions/ubuntu-helpers @@ -49,9 +49,7 @@ profile sanitized_helper { # Allow exec of anything, but under this profile. Allow transition # to other profiles if they exist. - /{usr/,}bin/* Pixr, - /{usr/,}sbin/* Pixr, - /usr/local/bin/* Pixr, + /{usr/,usr/local/,}{bin,sbin}/* Pixr, # Allow exec of libexec applications in /usr/lib* and /usr/local/lib* /usr/{,local/}lib*/{,**/}* Pixr, diff --git a/apparmor.d/abstractions/video b/apparmor.d/abstractions/video index 61cebaed6..00a834681 100644 --- a/apparmor.d/abstractions/video +++ b/apparmor.d/abstractions/video @@ -2,5 +2,5 @@ # video device access # System devices - /sys/class/video4linux r, - /sys/class/video4linux/** r, + @{sys}/class/video4linux r, + @{sys}/class/video4linux/** r, diff --git a/apparmor.d/abstractions/vulkan b/apparmor.d/abstractions/vulkan new file mode 100644 index 000000000..7f0d8cb98 --- /dev/null +++ b/apparmor.d/abstractions/vulkan @@ -0,0 +1,15 @@ +# vim:syntax=apparmor +# Vulkan access requirements + + # System files + /dev/dri/ r, # libvulkan_radeon.so, libvulkan_intel.so (Mesa) + /etc/vulkan/icd.d/{,*.json} r, + /etc/vulkan/{explicit,implicit}_layer.d/{,*.json} r, + # for drmGetMinorNameForFD() from libvulkan_intel.so (Mesa) + @{sys}/devices/pci[0-9]*/*/drm/ r, + /usr/share/vulkan/icd.d/{,*.json} r, + /usr/share/vulkan/{explicit,implicit}_layer.d/{,*.json} r, + + # User files + owner @{HOME}/.local/share/vulkan/implicit_layer.d/{,*.json} r, + diff --git a/apparmor.d/local/lsb_release b/apparmor.d/local/lsb_release new file mode 100644 index 000000000..e69de29bb diff --git a/apparmor.d/local/nvidia_modprobe b/apparmor.d/local/nvidia_modprobe new file mode 100644 index 000000000..e69de29bb diff --git a/apparmor.d/lsb_release b/apparmor.d/lsb_release new file mode 100644 index 000000000..5c05ba4db --- /dev/null +++ b/apparmor.d/lsb_release @@ -0,0 +1,50 @@ +# Note: This profile does not specify an attachment path because it is +# intended to be used only via "Px -> lsb_release" exec transitions from +# other profiles. We want to confine the lsb_release(1) utility when it +# is invoked from other confined applications, but not when it is used +# in regular (unconfined) shell scripts or run directly by the user. + +#include + +# Do not attach to /usr/bin/lsb_release by default +profile lsb_release { + #include + #include + + owner @{PROC}/@{pid}/fd/ r, + + /dev/tty rw, + + /usr/bin/lsb_release r, + /usr/bin/python3.[0-9] mr, + + /etc/debian_version r, + /etc/default/apport r, + /etc/dpkg/origins/** r, + /etc/lsb-release r, + /etc/lsb-release.d/ r, + + /{usr/,}bin/bash ixr, + /{usr/,}bin/dash ixr, + /usr/bin/basename ixr, + /usr/bin/dpkg-query ixr, + /usr/bin/getopt ixr, + /usr/bin/sed ixr, + /usr/bin/tr ixr, + + # TODO - many more permissions needed for this to work + deny /usr/bin/apt-cache x, + + /usr/bin/ r, + /usr/include/python*/pyconfig.h r, + /usr/share/distro-info/** r, + /usr/share/dpkg/** r, + /usr/share/terminfo/** r, + /var/lib/dpkg/** r, + + # file_inherit + deny /tmp/gtalkplugin.log w, + + # Site-specific additions and overrides. See local/README for details. + #include +} diff --git a/apparmor.d/nvidia_modprobe b/apparmor.d/nvidia_modprobe new file mode 100644 index 000000000..01f714ca7 --- /dev/null +++ b/apparmor.d/nvidia_modprobe @@ -0,0 +1,63 @@ +# vim:syntax=apparmor + +#include + +profile nvidia_modprobe { + #include + + # Capabilities + + capability chown, + capability mknod, + capability setuid, + capability sys_admin, + + # Main executable + + /usr/bin/nvidia-modprobe mr, + + # Other executables + + /usr/bin/kmod Cx -> kmod, + + # System files + + /dev/nvidia-uvm w, + /dev/nvidia-uvm-tools w, + @{sys}/bus/pci/devices/ r, + @{sys}/devices/pci[0-9]*/**/config r, + @{PROC}/devices r, + @{PROC}/modules r, + @{PROC}/sys/kernel/modprobe r, + + # Child profiles + + profile kmod { + #include + + # Capabilities + + capability sys_module, + + # Main executable + + /usr/bin/kmod mrix, + + # Other executables + + /{,usr/}bin/{,ba,da}sh ix, + + # System files + + /etc/modprobe.d/{,*.conf} r, + /etc/nvidia/current/*.conf r, + @{sys}/module/ipmi_devintf/initstate r, + @{sys}/module/ipmi_msghandler/initstate r, + @{sys}/module/nvidia/initstate r, + @{PROC}/cmdline r, + } + + # Site-specific additions and overrides. See local/README for details. + #include +} + diff --git a/apparmor.d/sbin.dhclient b/apparmor.d/sbin.dhclient index b1412092f..b6e2b9dfa 100644 --- a/apparmor.d/sbin.dhclient +++ b/apparmor.d/sbin.dhclient @@ -1,7 +1,7 @@ # vim:syntax=apparmor #include -/sbin/dhclient flags=(attach_disconnected) { +/{,usr/}sbin/dhclient flags=(attach_disconnected) { #include #include #include @@ -17,9 +17,9 @@ @{PROC}/[0-9]*/net/ r, @{PROC}/[0-9]*/net/** r, - /sbin/dhclient mr, + /{,usr/}sbin/dhclient mr, # LP: #1197484 and LP: #1202203 - why is this needed? :( - /bin/bash mr, + /{,usr/}bin/bash mr, /etc/dhclient.conf r, /etc/dhcp/ r, @@ -54,7 +54,7 @@ # able to subvert dhclient-script or write to the hooks.d directories. As # such, if the dhclient3 daemon is subverted, this effectively limits it to # only being able to run the hooks scripts. - /sbin/dhclient-script Uxr, + /{,usr/}sbin/dhclient-script Uxr, # Run the ELF executables under their own unrestricted profiles /usr/lib/NetworkManager/nm-dhcp-client.action Pxrm, diff --git a/apparmor.d/tunables/global b/apparmor.d/tunables/global index 58d087fbe..28d6fc6dc 100644 --- a/apparmor.d/tunables/global +++ b/apparmor.d/tunables/global @@ -18,3 +18,4 @@ #include #include #include +#include diff --git a/apparmor.d/tunables/kernelvars b/apparmor.d/tunables/kernelvars index 7933c522c..65ee2667f 100644 --- a/apparmor.d/tunables/kernelvars +++ b/apparmor.d/tunables/kernelvars @@ -20,3 +20,14 @@ #A pattern for pids that can appear @{pids}=@{pid} + +# Placeholder for user id until kernel var is implemented to match +# current user of the confined application. +# Values are 0...4,294,967,295 (32-bit unsigned, 10 digits). +@{uid}={[0-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9],[1-4][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]} + +#same pattern as @{uid} for now +@{uids}=@{uid} + +# until kernel var is implemented +@{sys}=/sys/ diff --git a/apparmor.d/tunables/securityfs b/apparmor.d/tunables/securityfs index 1350fee97..c572139fb 100644 --- a/apparmor.d/tunables/securityfs +++ b/apparmor.d/tunables/securityfs @@ -6,7 +6,5 @@ # # ------------------------------------------------------------------ -#include - # @{securityfs} is the location where securityfs is mounted. @{securityfs}=@{sys}/kernel/security/ diff --git a/apparmor.d/tunables/share b/apparmor.d/tunables/share new file mode 100644 index 000000000..f41121c8a --- /dev/null +++ b/apparmor.d/tunables/share @@ -0,0 +1,15 @@ +@{flatpak_exports_root} = {flatpak/exports,flatpak/{app,runtime}/*/*/*/*/export} + +# System-wide directories with behaviour analogous to /usr/share +# in patterns like the freedesktop.org basedir spec. These are +# owned by root or a system user, appear in XDG_DATA_DIRS, and +# are the parent directory for `applications`, `themes`, +# `dbus-1/services`, etc. +@{system_share_dirs} = /{usr,usr/local,var/lib/@{flatpak_exports_root}}/share + +# Per-user/personal directories with behaviour analogous to +# ~/.local/share in patterns like the freedesktop.org basedir spec. +# These are owned by the user running an application, appear in +# XDG_DATA_DIRS or XDG_DATA_HOME, and are the parent directory +# for the same subdirectories as @{system_share_dirs} +@{user_share_dirs} = @{HOME}/.local{,/share/@{flatpak_exports_root}}/share diff --git a/apparmor.d/tunables/sys b/apparmor.d/tunables/sys index e49702cb8..c5257e30c 100644 --- a/apparmor.d/tunables/sys +++ b/apparmor.d/tunables/sys @@ -6,5 +6,4 @@ # # ------------------------------------------------------------------ -# @{sys} is the location where sysfs is mounted. -@{sys}=/sys/ +#This file is DEPRECATED! @{sys} is defined in tunables/kernelvars now. diff --git a/apparmor.d/usr.bin.man b/apparmor.d/usr.bin.man index 173807955..b0160528e 100644 --- a/apparmor.d/usr.bin.man +++ b/apparmor.d/usr.bin.man @@ -20,8 +20,8 @@ # Similarly, use a special profile when man calls decompressors and other # simple filters. - /bin/bzip2 rmCx -> &man_filter, - /bin/gzip rmCx -> &man_filter, + /{,usr/}bin/bzip2 rmCx -> &man_filter, + /{,usr/}bin/gzip rmCx -> &man_filter, /usr/bin/col rmCx -> &man_filter, /usr/bin/compress rmCx -> &man_filter, /usr/bin/iconv rmCx -> &man_filter, @@ -34,12 +34,14 @@ # nice in the future, but is tricky since it's quite configurable), but to # confine the processes it calls that parse untrusted data. /** mrixwlk, + unix, capability setuid, capability setgid, - signal peer=man_groff, - signal peer=man_filter, + signal peer=@{profile_name}, + signal peer=/usr/bin/man//&man_groff, + signal peer=/usr/bin/man//&man_filter, # Site-specific additions and overrides. See local/README for details. #include @@ -64,10 +66,13 @@ profile man_groff { /usr/bin/vgrind rm, /etc/groff/** r, + /etc/papersize r, /usr/lib/groff/site-tmac/** r, /usr/share/groff/** r, signal peer=/usr/bin/man, + # @{profile_name} doesn't seem to work here. + signal peer=/usr/bin/man//&man_groff, } profile man_filter { @@ -77,8 +82,8 @@ profile man_filter { # open FDs before execve. #include - /bin/bzip2 rm, - /bin/gzip rm, + /{,usr/}bin/bzip2 rm, + /{,usr/}bin/gzip rm, /usr/bin/col rm, /usr/bin/compress rm, /usr/bin/iconv rm, @@ -91,5 +96,10 @@ profile man_filter { # do is feed data to the invoking man process. /** r, + # Allow writing cat pages. + /var/cache/man/** w, + signal peer=/usr/bin/man, + # @{profile_name} doesn't seem to work here. + signal peer=/usr/bin/man//&man_filter, } diff --git a/apparmor.d/usr.lib.ipsec.charon b/apparmor.d/usr.lib.ipsec.charon index c5dba27d3..7cdec0aeb 100644 --- a/apparmor.d/usr.lib.ipsec.charon +++ b/apparmor.d/usr.lib.ipsec.charon @@ -28,6 +28,7 @@ capability chown, capability setgid, capability setuid, + capability setpcap, # libcharon-extra-plugins: xauth-pam capability audit_write, @@ -35,15 +36,12 @@ # libstrongswan-standard-plugins: agent capability dac_override, - capability net_admin, - capability net_raw, - network, network raw, - /bin/dash rmPUx, + /{,usr/}bin/dash rmPUx, - # libchron-extra-plugins: kernel-libipsec + # libcharon-extra-plugins: kernel-libipsec /dev/net/tun rw, /etc/ipsec.conf r, @@ -71,6 +69,12 @@ /var/lib/strongswan/* r, + /{,var/}run/systemd/notify w, + + # allow self to read file descriptors (LP #1786250) + # restrict to our own process-ID as per apparmor vars + @{PROC}/@{pid}/fd/ r, + # for using the ha plugin (LP: #1773956) @{PROC}/@{pid}/net/ipt_CLUSTERIP/ r, @{PROC}/@{pid}/net/ipt_CLUSTERIP/* rw, diff --git a/apparmor.d/usr.sbin.mysqld b/apparmor.d/usr.sbin.mysqld index f9c91bbcc..185cceb8b 100644 --- a/apparmor.d/usr.sbin.mysqld +++ b/apparmor.d/usr.sbin.mysqld @@ -33,9 +33,13 @@ /var/run/mysqld/mysqld.pid rw, /var/run/mysqld/mysqld.sock rw, /var/run/mysqld/mysqld.sock.lock rw, + /var/run/mysqld/mysqlx.sock rw, + /var/run/mysqld/mysqlx.sock.lock rw, /run/mysqld/mysqld.pid rw, /run/mysqld/mysqld.sock rw, /run/mysqld/mysqld.sock.lock rw, + /run/mysqld/mysqlx.sock rw, + /run/mysqld/mysqlx.sock.lock rw, # Allow systemd notify messages /{,var/}run/systemd/notify w, @@ -70,6 +74,9 @@ /var/log/mysql/ r, /var/log/mysql/** rw, +# Allow read access to mecab files + /var/lib/mecab/dic/ipadic-utf8/** r, + # Allow read access to OpenSSL config /etc/ssl/openssl.cnf r, # Site-specific additions and overrides. See local/README for details. diff --git a/apparmor.d/usr.sbin.named b/apparmor.d/usr.sbin.named index 4d94706a5..a4622da85 100644 --- a/apparmor.d/usr.sbin.named +++ b/apparmor.d/usr.sbin.named @@ -22,6 +22,9 @@ /var/cache/bind/** lrw, /var/cache/bind/ rw, + # Database file used by allow-new-zones + /var/cache/bind/_default.nzd-lock rwk, + # gssapi /etc/krb5.keytab kr, /etc/bind/krb5.keytab kr, @@ -29,6 +32,9 @@ # ssl /etc/ssl/openssl.cnf r, + # root hints from dns-data-root + /usr/share/dns/root.* r, + # GeoIP data files for GeoIP ACLs /usr/share/GeoIP/** r, @@ -65,6 +71,24 @@ # dynamic updates /var/tmp/DNS_* rw, + # dyndb backends + /usr/lib/bind/*.so rm, + + # Samba DLZ + /{usr/,}lib/@{multiarch}/samba/bind9/*.so rm, + /{usr/,}lib/@{multiarch}/samba/gensec/*.so rm, + /{usr/,}lib/@{multiarch}/samba/ldb/*.so rm, + /{usr/,}lib/@{multiarch}/ldb/modules/ldb/*.so rm, + /var/lib/samba/bind-dns/dns.keytab rk, + /var/lib/samba/bind-dns/named.conf r, + /var/lib/samba/bind-dns/dns/** rwk, + /var/lib/samba/private/dns.keytab rk, + /var/lib/samba/private/named.conf r, + /var/lib/samba/private/dns/** rwk, + /etc/samba/smb.conf r, + /dev/urandom rwmk, + owner /var/tmp/krb5_* rwk, + # Site-specific additions and overrides. See local/README for details. #include } diff --git a/apparmor.d/usr.sbin.rsyslogd b/apparmor.d/usr.sbin.rsyslogd index d9b502ad1..3e74588c8 100644 --- a/apparmor.d/usr.sbin.rsyslogd +++ b/apparmor.d/usr.sbin.rsyslogd @@ -29,6 +29,7 @@ /var/spool/rsyslog/ r, /var/spool/rsyslog/** rwk, + /usr/sbin/rsyslogd mr, /usr/lib{,32,64}/{,@{multiarch}/}rsyslog/*.so mr, /dev/tty* rw, diff --git a/apparmor.d/usr.sbin.tcpdump b/apparmor.d/usr.sbin.tcpdump index 7a7da4f95..d0a7037a3 100644 --- a/apparmor.d/usr.sbin.tcpdump +++ b/apparmor.d/usr.sbin.tcpdump @@ -10,6 +10,7 @@ capability setuid, capability setgid, capability dac_override, + capability chown, network raw, network packet, @@ -18,10 +19,11 @@ @{PROC}/bus/usb/** r, # for finding an interface + /dev/ r, @{PROC}/[0-9]*/net/dev r, /sys/bus/usb/devices/ r, /sys/class/net/ r, - /sys/devices/**/net/* r, + /sys/devices/**/net/** r, # for -j capability net_admin, diff --git a/apparmor/parser.conf b/apparmor/parser.conf index 8db26269c..641cf1db8 100644 --- a/apparmor/parser.conf +++ b/apparmor/parser.conf @@ -21,7 +21,6 @@ #Include /etc/apparmor.d/ # or #Include /usr/share/apparmor -Include /usr/share/apparmor ## Set location of apparmor filesystem diff --git a/apparmor/subdomain.conf b/apparmor/subdomain.conf deleted file mode 100644 index 20e7cab91..000000000 --- a/apparmor/subdomain.conf +++ /dev/null @@ -1,53 +0,0 @@ -# subdomain.conf is a shared AppArmor configuration file that is sh sourcable. - -################## AppArmor init.d configuration ################ - -# Move this to /etc/sysconfig/apparmor eventually -## Path: System/AppArmor -## Description: Enable the OWLSM extension to AppArmor -## Type: yesno -## Default: no -# -# Enable OWLSM extension to AppArmor? -# OWLSM is an extension to AppArmor that prevents processes from -# following symlinks they don't own and creating hardlinks to files they -# don't own, in an attempt to prevent /tmp race attacks. However, OWLSM -# can break some applications, so is disabled by default. -SUBDOMAIN_ENABLE_OWLSM="no" - -## Path: System/AppArmor -## Description: Enable the AppArmor event daemon for reporting -## Type: yesno -## Default: no -# -# Enable the AppArmor event daemon for reporting? -APPARMOR_ENABLE_AAEVENTD="no" - -#SUBDOMAIN_MODULE_PANIC=XXX -#This option controls how subdomain behaves when the init script attempts -#to load the AppArmor module and fails. There are 4 options -#warn - log a failure message. (default behavior) -#build - attempt to build the AppArmor module is the module can't be loaded. -# If successful -# the module will be built for the running kernel and loaded. -# If the build fails -# a failure message is logged -#panic - If the AppArmor module fails to load -# a failure message will be logged -# and the machine will drop to runlevel 1 (single user) -#build-panic - If the AppArmor module fails to load -# attempt to build the module -# If building the module fails -# panic (drop to runlevel 1) - -#SUBDOMAIN_MODULE_PANIC=warn - -################## subdomain_parser configuration ################ - -#SUBDOMAIN_PATH=XXXX -#This option specifies the include path that the subdomain_parser will -#use by default. If no entry is specified /etc/subdomain.d is used by -#default. - -#SUBDOMAIN_PATH=/etc/subdomain.d - diff --git a/apt/apt.conf.d/01-vendor-ubuntu b/apt/apt.conf.d/01-vendor-ubuntu index 44e684710..30d25a717 100644 --- a/apt/apt.conf.d/01-vendor-ubuntu +++ b/apt/apt.conf.d/01-vendor-ubuntu @@ -1 +1,2 @@ Acquire::Changelogs::AlwaysOnline "true"; +Acquire::http::User-Agent-Non-Interactive "true"; diff --git a/apt/apt.conf.d/01autoremove b/apt/apt.conf.d/01autoremove index f9d9e85d4..478c571e0 100644 --- a/apt/apt.conf.d/01autoremove +++ b/apt/apt.conf.d/01autoremove @@ -10,31 +10,13 @@ APT VersionedKernelPackages { - # linux kernels - "linux-image"; - "linux-headers"; - "linux-image-extra"; - "linux-modules"; - "linux-modules-extra"; - "linux-signed-image"; - "linux-image-unsigned"; - # kfreebsd kernels - "kfreebsd-image"; - "kfreebsd-headers"; - # hurd kernels - "gnumach-image"; + # kernels + "linux-.*"; + "kfreebsd-.*"; + "gnumach-.*"; # (out-of-tree) modules ".*-modules"; ".*-kernel"; - "linux-backports-modules-.*"; - "linux-modules-.*"; - # tools - "linux-tools"; - "linux-cloud-tools"; - # build info - "linux-buildinfo"; - # source code - "linux-source"; }; Never-MarkAuto-Sections diff --git a/apt/apt.conf.d/01autoremove-kernels b/apt/apt.conf.d/01autoremove-kernels index 8cbac721e..0ce4acfbd 100644 --- a/apt/apt.conf.d/01autoremove-kernels +++ b/apt/apt.conf.d/01autoremove-kernels @@ -1,65 +1,47 @@ // DO NOT EDIT! File autogenerated by /etc/kernel/postinst.d/apt-auto-removal APT::NeverAutoRemove { - "^linux-image-4\.15\.0-109-generic$"; - "^linux-image-4\.15\.0-64-generic$"; - "^linux-headers-4\.15\.0-109-generic$"; - "^linux-headers-4\.15\.0-64-generic$"; - "^linux-image-extra-4\.15\.0-109-generic$"; - "^linux-image-extra-4\.15\.0-64-generic$"; - "^linux-modules-4\.15\.0-109-generic$"; - "^linux-modules-4\.15\.0-64-generic$"; - "^linux-modules-extra-4\.15\.0-109-generic$"; - "^linux-modules-extra-4\.15\.0-64-generic$"; - "^linux-signed-image-4\.15\.0-109-generic$"; - "^linux-signed-image-4\.15\.0-64-generic$"; - "^linux-image-unsigned-4\.15\.0-109-generic$"; - "^linux-image-unsigned-4\.15\.0-64-generic$"; - "^kfreebsd-image-4\.15\.0-109-generic$"; - "^kfreebsd-image-4\.15\.0-64-generic$"; - "^kfreebsd-headers-4\.15\.0-109-generic$"; - "^kfreebsd-headers-4\.15\.0-64-generic$"; - "^gnumach-image-4\.15\.0-109-generic$"; - "^gnumach-image-4\.15\.0-64-generic$"; + "^linux-.*-4\.15\.0-109-generic$"; + "^linux-.*-4\.15\.0-64-generic$"; + "^linux-.*-5\.4\.0-40-generic$"; + "^kfreebsd-.*-4\.15\.0-109-generic$"; + "^kfreebsd-.*-4\.15\.0-64-generic$"; + "^kfreebsd-.*-5\.4\.0-40-generic$"; + "^gnumach-.*-4\.15\.0-109-generic$"; + "^gnumach-.*-4\.15\.0-64-generic$"; + "^gnumach-.*-5\.4\.0-40-generic$"; "^.*-modules-4\.15\.0-109-generic$"; "^.*-modules-4\.15\.0-64-generic$"; + "^.*-modules-5\.4\.0-40-generic$"; "^.*-kernel-4\.15\.0-109-generic$"; "^.*-kernel-4\.15\.0-64-generic$"; - "^linux-backports-modules-.*-4\.15\.0-109-generic$"; - "^linux-backports-modules-.*-4\.15\.0-64-generic$"; - "^linux-modules-.*-4\.15\.0-109-generic$"; - "^linux-modules-.*-4\.15\.0-64-generic$"; - "^linux-tools-4\.15\.0-109-generic$"; - "^linux-tools-4\.15\.0-64-generic$"; - "^linux-cloud-tools-4\.15\.0-109-generic$"; - "^linux-cloud-tools-4\.15\.0-64-generic$"; - "^linux-buildinfo-4\.15\.0-109-generic$"; - "^linux-buildinfo-4\.15\.0-64-generic$"; - "^linux-source-4\.15\.0-109-generic$"; - "^linux-source-4\.15\.0-64-generic$"; + "^.*-kernel-5\.4\.0-40-generic$"; }; /* Debug information: # dpkg list: -iF linux-image-4.15.0-109-generic 4.15.0-109.110 amd64 Signed kernel image generic -ii linux-image-4.15.0-38-generic 4.15.0-38.41 amd64 Signed kernel image generic -ii linux-image-4.15.0-64-generic 4.15.0-64.73 amd64 Signed kernel image generic -ii linux-image-generic 4.15.0.109.97 amd64 Generic Linux kernel image +ii linux-image-4.15.0-109-generic 4.15.0-109.110 amd64 Signed kernel image generic +rc linux-image-4.15.0-38-generic 4.15.0-38.41 amd64 Signed kernel image generic +ii linux-image-4.15.0-64-generic 4.15.0-64.73 amd64 Signed kernel image generic +iF linux-image-5.4.0-40-generic 5.4.0-40.44 amd64 Signed kernel image generic +ii linux-image-generic 5.4.0.40.43 amd64 Generic Linux kernel image # list of installed kernel packages: 4.15.0-109-generic 4.15.0-109.110 -4.15.0-38-generic 4.15.0-38.41 4.15.0-64-generic 4.15.0-64.73 +5.4.0-40-generic 5.4.0-40.44 # list of different kernel versions: +5.4.0-40.44 4.15.0-109.110 4.15.0-64.73 -4.15.0-38.41 -# Installing kernel: 4.15.0-109.110 (4.15.0-109-generic) +# Installing kernel: 5.4.0-40.44 (5.4.0-40-generic) # Running kernel: 4.15.0-64.73 (4.15.0-64-generic) -# Last kernel: 4.15.0-109.110 -# Previous kernel: 4.15.0-64.73 +# Last kernel: 5.4.0-40.44 +# Previous kernel: 4.15.0-109.110 # Kernel versions list to keep: 4.15.0-109.110 4.15.0-64.73 +5.4.0-40.44 # Kernel packages (version part) to protect: 4\.15\.0-109-generic 4\.15\.0-64-generic +5\.4\.0-40-generic */ diff --git a/apt/apt.conf.d/20apt-show-versions b/apt/apt.conf.d/20apt-show-versions index a48ab785a..97f59d22b 100644 --- a/apt/apt.conf.d/20apt-show-versions +++ b/apt/apt.conf.d/20apt-show-versions @@ -1,4 +1,4 @@ -// When Apt's cache is updated (i.e. apt-cache update) +// When Apt's cache is updated (i.e. apt-get update) APT::Update::Post-Invoke-Success { "test -x /usr/bin/apt-show-versions || exit 0 ; apt-show-versions -i"; }; diff --git a/avahi/services/phpmyadmin.service b/avahi/services/phpmyadmin.service new file mode 100644 index 000000000..077c92655 --- /dev/null +++ b/avahi/services/phpmyadmin.service @@ -0,0 +1,10 @@ + + + + phpMyAdmin on %h + + _http._tcp + 80 + path=/phpmyadmin/ + + diff --git a/bash_completion.d/grub b/bash_completion.d/grub deleted file mode 100644 index 29a596343..000000000 --- a/bash_completion.d/grub +++ /dev/null @@ -1,495 +0,0 @@ -# -# Bash completion for grub -# -# Copyright (C) 2010 Free Software Foundation, Inc. -# -# GRUB is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# GRUB is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with GRUB. If not, see . -# bash completion for grub - -__grub_dir() { - local i c=1 boot_dir - - for (( c=1; c <= ${#COMP_WORDS[@]}; c++ )); do - i="${COMP_WORDS[c]}" - case "$i" in - --boot-directory) - c=$((++c)) - i="${COMP_WORDS[c]}" - boot_dir="${i##*=}"; - break - ;; - esac - done - boot_dir=${boot_dir-/boot} - echo "${boot_dir%/}/grub" -} - - -# This function generates completion reply with compgen -# - arg: accepts 1, 2, 3, or 4 arguments -# $1 wordlist separate by space, tab or newline -# $2 (optional) prefix to add -# $3 (optional) current word to complete -# $4 (optional) suffix to add -__grubcomp () { - local cur="${COMP_WORDS[COMP_CWORD]}" - if [ $# -gt 2 ]; then - cur="$3" - fi - case "$cur" in - --*=) - COMPREPLY=() - ;; - *) - local IFS=' '$'\t'$'\n' - COMPREPLY=($(compgen -P "${2-}" -W "${1-}" -S "${4-}" -- "$cur")) - ;; - esac -} - -# Function that return long options from the help of the command -# - arg: $1 (optional) command to get the long options from -__grub_get_options_from_help () { - local prog - - if [ $# -ge 1 ]; then - prog="$1" - else - prog="${COMP_WORDS[0]}" - fi - - local i IFS=" "$'\t'$'\n' - for i in $(LC_ALL=C $prog --help) - do - case $i in - --*) echo "${i%=*}";; - esac - done -} - -# Function that return long options from the usage of the command -# - arg: $1 (optional) command to get the long options from -__grub_get_options_from_usage () { - local prog - - if [ $# -ge 1 ]; then - prog="$1" - else - prog="${COMP_WORDS[0]}" - fi - - local i IFS=" "$'\t'$'\n' - for i in $(LC_ALL=C $prog --usage) - do - case $i in - \[--*\]) i=${i#[} # Remove leading [ - echo ${i%%?(=*)]} # Remove optional value and trailing ] - ;; - esac - done -} - -__grub_get_last_option () { - local i - for (( i=$COMP_CWORD-1; i > 0; i-- )); do - if [[ "${COMP_WORDS[i]}" == -* ]]; then - echo "${COMP_WORDS[i]}" - break; - fi - done -} - -__grub_list_menuentries () { - local cur="${COMP_WORDS[COMP_CWORD]}" - local config_file=$(__grub_dir)/grub.cfg - - if [ -f "$config_file" ];then - local IFS=$'\n' - COMPREPLY=( $(compgen \ - -W "$( awk -F "[\"']" '/menuentry/ { print $2 }' $config_file )" \ - -- "$cur" )) #'# Help emacs syntax highlighting - fi -} - -__grub_list_modules () { - local grub_dir=$(__grub_dir) - local IFS=$'\n' - COMPREPLY=( $( compgen -f -X '!*/*.mod' -- "${grub_dir}/$cur" | { - while read -r tmp; do - [ -n $tmp ] && { - tmp=${tmp##*/} - printf '%s\n' ${tmp%.mod} - } - done - } - )) -} - -# -# grub-set-default & grub-reboot -# -_grub_set_entry () { - local cur prev split=false - - COMPREPLY=() - cur=`_get_cword` - prev=${COMP_WORDS[COMP_CWORD-1]} - - _split_longopt && split=true - - case "$prev" in - --boot-directory) - _filedir -d - return - ;; - esac - - $split && return 0 - - if [[ "$cur" == -* ]]; then - __grubcomp "$(__grub_get_options_from_help)" - else - # Default complete with a menuentry - __grub_list_menuentries - fi -} - -__grub_set_default_program="grub-set-default" -have ${__grub_set_default_program} && \ - complete -F _grub_set_entry -o filenames ${__grub_set_default_program} -unset __grub_set_default_program - -__grub_reboot_program="grub-reboot" -have ${__grub_reboot_program} && \ - complete -F _grub_set_entry -o filenames ${__grub_reboot_program} -unset __grub_reboot_program - - -# -# grub-editenv -# -_grub_editenv () { - local cur prev - - COMPREPLY=() - cur=`_get_cword` - prev=${COMP_WORDS[COMP_CWORD-1]} - - case "$prev" in - create|list|set|unset) - COMPREPLY=( "" ) - return - ;; - esac - - __grubcomp "$(__grub_get_options_from_help) - create list set unset" -} - -__grub_editenv_program="grub-editenv" -have ${__grub_editenv_program} && \ - complete -F _grub_editenv -o filenames ${__grub_editenv_program} -unset __grub_editenv_program - - -# -# grub-mkconfig -# -_grub_mkconfig () { - local cur prev - - COMPREPLY=() - cur=`_get_cword` - - if [[ "$cur" == -* ]]; then - __grubcomp "$(__grub_get_options_from_help)" - else - _filedir - fi -} -__grub_mkconfig_program="grub-mkconfig" -have ${__grub_mkconfig_program} && \ - complete -F _grub_mkconfig -o filenames ${__grub_mkconfig_program} -unset __grub_mkconfig_program - - -# -# grub-setup -# -_grub_setup () { - local cur prev split=false - - COMPREPLY=() - cur=`_get_cword` - prev=${COMP_WORDS[COMP_CWORD-1]} - - _split_longopt && split=true - - case "$prev" in - -d|--directory) - _filedir -d - return - ;; - esac - - $split && return 0 - - if [[ "$cur" == -* ]]; then - __grubcomp "$(__grub_get_options_from_help)" - else - # Default complete with a filename - _filedir - fi -} - -__grub_bios_setup_program="grub-bios-setup" -have ${__grub_bios_setup_program} && \ - complete -F _grub_setup -o filenames ${__grub_bios_setup_program} -unset __grub_bios_setup_program - -__grub_sparc64_setup_program="grub-sparc64-setup" -have ${__grub_sparc64_setup_program} && \ - complete -F _grub_setup -o filenames ${__grub_sparc64_setup_program} -unset __grub_sparc64_setup_program - - -# -# grub-install -# -_grub_install () { - local cur prev last split=false - - COMPREPLY=() - cur=`_get_cword` - prev=${COMP_WORDS[COMP_CWORD-1]} - last=$(__grub_get_last_option) - - _split_longopt && split=true - - case "$prev" in - --boot-directory) - _filedir -d - return - ;; - --disk-module) - __grubcomp "biosdisk ata" - return - ;; - esac - - $split && return 0 - - if [[ "$cur" == -* ]]; then - __grubcomp "$(__grub_get_options_from_help)" - else - case "$last" in - --modules) - __grub_list_modules - return - ;; - esac - - # Default complete with a filename - _filedir - fi -} -__grub_install_program="grub-install" -have ${__grub_install_program} && \ - complete -F _grub_install -o filenames ${__grub_install_program} -unset __grub_install_program - - -# -# grub-mkfont -# -_grub_mkfont () { - local cur - - COMPREPLY=() - cur=`_get_cword` - - if [[ "$cur" == -* ]]; then - __grubcomp "$(__grub_get_options_from_help)" - else - # Default complete with a filename - _filedir - fi -} -__grub_mkfont_program="grub-mkfont" -have ${__grub_mkfont_program} && \ - complete -F _grub_mkfont -o filenames ${__grub_mkfont_program} -unset __grub_mkfont_program - - -# -# grub-mkrescue -# -_grub_mkrescue () { - local cur prev last - - COMPREPLY=() - cur=`_get_cword` - prev=${COMP_WORDS[COMP_CWORD-1]} - last=$(__grub_get_last_option) - - if [[ "$cur" == -* ]]; then - __grubcomp "$(__grub_get_options_from_help)" - else - case "$last" in - --modules) - __grub_list_modules - return - ;; - esac - - # Default complete with a filename - _filedir - fi -} -__grub_mkrescue_program="grub-mkrescue" -have ${__grub_mkrescue_program} && \ - complete -F _grub_mkrescue -o filenames ${__grub_mkrescue_program} -unset __grub_mkrescue_program - - -# -# grub-mkimage -# -_grub_mkimage () { - local cur prev split=false - - COMPREPLY=() - cur=`_get_cword` - prev=${COMP_WORDS[COMP_CWORD-1]} - - _split_longopt && split=true - - case "$prev" in - -d|--directory|-p|--prefix) - _filedir -d - return - ;; - -O|--format) - # Get available format from help - local prog=${COMP_WORDS[0]} - __grubcomp "$(LC_ALL=C $prog --help | \ - awk -F ":" '/available formats/ { print $2 }' | \ - sed 's/, / /g')" - return - ;; - esac - - $split && return 0 - - if [[ "$cur" == -* ]]; then - __grubcomp "$(__grub_get_options_from_help)" - else - # Default complete with a filename - _filedir - fi -} -__grub_mkimage_program="grub-mkimage" -have ${__grub_mkimage_program} && \ - complete -F _grub_mkimage -o filenames ${__grub_mkimage_program} -unset __grub_mkimage_program - - -# -# grub-mkpasswd-pbkdf2 -# -_grub_mkpasswd_pbkdf2 () { - local cur - - COMPREPLY=() - cur=`_get_cword` - - if [[ "$cur" == -* ]]; then - __grubcomp "$(__grub_get_options_from_help)" - else - # Default complete with a filename - _filedir - fi -} -__grub_mkpasswd_pbkdf2_program="grub-mkpasswd-pbkdf2" -have ${__grub_mkpasswd_pbkdf2_program} && \ - complete -F _grub_mkpasswd_pbkdf2 -o filenames ${__grub_mkpasswd_pbkdf2_program} -unset __grub_mkpasswd_pbkdf2_program - - -# -# grub-probe -# -_grub_probe () { - local cur prev split=false - - COMPREPLY=() - cur=`_get_cword` - prev=${COMP_WORDS[COMP_CWORD-1]} - - _split_longopt && split=true - - case "$prev" in - -t|--target) - # Get target type from help - local prog=${COMP_WORDS[0]} - __grubcomp "$(LC_ALL=C $prog --help | \ - awk -F "[()]" '/--target=/ { print $2 }' | \ - sed 's/|/ /g')" - return - ;; - esac - - $split && return 0 - - if [[ "$cur" == -* ]]; then - __grubcomp "$(__grub_get_options_from_help)" - else - # Default complete with a filename - _filedir - fi -} -__grub_probe_program="grub-probe" -have ${__grub_probe_program} && \ - complete -F _grub_probe -o filenames ${__grub_probe_program} -unset __grub_probe_program - - -# -# grub-script-check -# -_grub_script_check () { - local cur - - COMPREPLY=() - cur=`_get_cword` - - if [[ "$cur" == -* ]]; then - __grubcomp "$(__grub_get_options_from_help)" - else - # Default complete with a filename - _filedir - fi -} -__grub_script_check_program="grub-script-check" -have ${__grub_script_check_program} && \ - complete -F _grub_script_check -o filenames ${__grub_script_check_program} - - -# Local variables: -# mode: shell-script -# sh-basic-offset: 4 -# sh-indent-comment: t -# indent-tabs-mode: nil -# End: -# ex: ts=4 sw=4 et filetype=sh diff --git a/bind/bind.keys b/bind/bind.keys index 5e5a32ba9..6d4217f1a 100644 --- a/bind/bind.keys +++ b/bind/bind.keys @@ -4,42 +4,30 @@ # be configured elsewhere; if they are configured here, they will not be # recognized or used by named. # -# The built-in trust anchors are provided for convenience of configuration. -# They are not activated within named.conf unless specifically switched on. -# To use the built-in key, use "dnssec-validation auto;" in the -# named.conf options. Without this option being set, the keys in this -# file are ignored. +# To use the built-in root key, set "dnssec-validation auto;" in the +# named.conf options, or else leave "dnssec-validation" unset. If +# "dnssec-validation" is set to "yes", then the keys in this file are +# ignored; keys will need to be explicitly configured in named.conf for +# validation to work. "auto" is the default setting, unless named is +# built with "configure --disable-auto-validation", in which case the +# default is "yes". # # This file is NOT expected to be user-configured. # -# These keys are current as of October 2017. If any key fails to -# initialize correctly, it may have expired. In that event you should -# replace this file with a current version. The latest version of -# bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys. +# Servers being set up for the first time can use the contents of this file +# as initializing keys; thereafter, the keys in the managed key database +# will be trusted and maintained automatically. # -# See https://data.iana.org/root-anchors/root-anchors.xml -# for current trust anchor information for the root zone. - -managed-keys { - # This key (19036) is to be phased out starting in 2017. It will - # remain in the root zone for some time after its successor key - # has been added. It will remain this file until it is removed from - # the root zone. - . initial-key 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF - FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX - bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD - X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz - W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS - Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq - QxA+Uk1ihz0="; +# These keys are current as of Mar 2019. If any key fails to initialize +# correctly, it may have expired. In that event you should replace this +# file with a current version. The latest version of bind.keys can always +# be obtained from ISC at https://www.isc.org/bind-keys. +# +# See https://data.iana.org/root-anchors/root-anchors.xml for current trust +# anchor information for the root zone. +trust-anchors { # This key (20326) was published in the root zone in 2017. - # Servers which were already using the old key (19036) should - # roll seamlessly to this new one via RFC 5011 rollover. Servers - # being set up for the first time can use the contents of this - # file as initializing keys; thereafter, the keys in the - # managed key database will be trusted and maintained - # automatically. . initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3 +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF diff --git a/bind/named.conf.default-zones b/bind/named.conf.default-zones index 355338bda..1a85ad34d 100644 --- a/bind/named.conf.default-zones +++ b/bind/named.conf.default-zones @@ -1,7 +1,7 @@ // prime the server with knowledge of the root servers zone "." { type hint; - file "/etc/bind/db.root"; + file "/usr/share/dns/root.hints"; }; // be authoritative for the localhost forward and reverse zones, and for diff --git a/console-setup/Uni2-Fixed16.psf.gz b/console-setup/Uni2-Fixed16.psf.gz index 52c26d4e6dc09ed8053b89d4ae8bc437dbbd36b6..37eb6549a069e3ac743378f24abac3ea0d6f36d2 100644 GIT binary patch literal 4151 zcmV-75XkQziwFP!0000219h1RcwEJOz{k4}u{MjmUW8ejwfwZ+F|rI;HpZ64vR*A~ zu`7(R1vX#|$O05h;D7A&SMx`8_vb0;zneXQBsR z$NQrH&Lrv^A0O`%G1qA5XZ7~m>zPc?#*LrW^6$^txM72pE>|p8tIaCTNtzZW%GK&% zzmgL(6N&yo6+753#Bnth>pM>$)*D|x6RE(V9Z|jp*FQtKcE9ur8A=J2zL>Mq>(Z)` z^1U|qM3jTjled+Xa+;1MXWXWnF+y0Ps(-Y82}j3AUA5Zs^&zHorn0(91za>fo6R4h=0&rDiW$G^ph~CFEDFsSd6(rALZ$QmKsRQYlBtt_mra z$+)IQjh=i@BW2fcB3=yrOqM`sPHtB&r=N+0_er->G2=t)ujt38a^1QDWiwi;iL^@I z4CQxfe<$c))jvabtY1 z^;g?zwO^%Z#^j2Xe_c3URbKCN{`bme`1<;v?|80O^Yu}!)z^=VtgqMn^cCZpro6GS z&6~sWs-vUB!$U)ZgVj*K_WbkO7p15f@Kts(SK21f&b$$HkM1PIWbW2)8LHU0BX?D);f2LJh zj{v9Mt1F}iK-mAe*mx1*%7%7Ej+8Ir_T0peZZRXkw8z(|inqpx*M2ns{QN=l(xHWo z>O&b9)yGC2(A8TJ#;XAk*3ZknaBdtx$`BJ1qYaNcjUK6XAC$Y3K81`&B zJ9$2Z^I2t3E4E#KwF9vGGgpj`k77*jO-JOMvZ|5sWQ`y7JzZW{elaHN@}lwf_{ha% zl|Gcc)RsL{)v;yOy12c<0yU>WQ&rsFn=MJ=AR94WRjfK%-cX!9!LT#NTXJ_}U zt6JsR`Lo$#v0f}@v%Xwc0OV8K_iM!#gjPI# zbj1^`cz!#+87$DD^=;bwA+)IW58wn8uy|5acjLF@SMHj zZW@(o`@?|%jdHBG{(5~b>*>kodwRn4SDzwQ^tj%JexhKUwcoM6KY@M2l~WV3{nW&? zX}Wyh`SH7rYw7syX1sTruXkou^{NvC!O2loFs$E1WHg)8MQ}tFBe}NRh^0xSTw5ro zOodaC`D*IRXz{usXPsP4{WIO&naTUFXnRC-^RHXjX}52uHUKx8{&n4Qbf2ePAo~Ww zw-38-zWL49AGl}Nu3g?{EMk9@T-F1CKDx?pE)$8~8<-G*ti*wVsrRo9UpYoDTg6R% zKd`hh!#koGd39acgIaJNTG(hr6yAu*)Wz6WuT)FMU3}L0TP__6+fQe=_qF%g>&?8v zn#P7gu-{b|8fLS0u(x@-yrUzXRtG*Ol{w({TB!Yvf10%3j%JIwi~aS=+pWa*Bhmdz zR905amQ{Xx|Dw{{axo?|Y$N9@^*viw`E9vaoO~Wr=e_s*^PaWashayDTh7JyGphda z^Ot84!($4kgTbMp;o;H3mWs7o3d^s?%8%`jDiu}1+D_lz>Mw@-n`P;af|5*nt45|i ziIT2BsbcSUg8jJbmKg5E?q1dhvZ?U3YLiHRn@x zUgf~*2KO)NtUJ!1n@wx=MeZNGR)_uPk1y-~LBBEQQKPRg-q)8OuTGHmeFd?T&adHo zNwr1KvzfG~-N<>t|Du0BVVQ{BM_9XQJ)d&XcqPZruayeN+x_8rB$t|z_Kb)>U!(hL z^(NeZtMa1p>P;B0Qb+GI{QUm@Or?&-`}zHNqyKO``ugupS0|r`_4u{V$LjnQov+~= z)4$R2tlyaNtk#5RynbVkcWXXnV)H2zt)IRTE9RoNqopZt4X3p4ZN7c8#+!a)#+#~L zG+w_k@j?FJK8!b({Rr|0@w~C(jr}wCXTA0KeM;qbfgIcbg!d`t`(c0j_4nh6!;zZu!sGrfL=_Dsv6J<{nzdxTt? zv>zzN*W=J0S^2#W>ipG7`J?x5VLUxb_t^S0_doXeG+)s1>X4-3D}&a3Gx@87dV4Tx z?#CkwB-HN(W`DeP zczAdR4Erm++U%6Q6OgwW=UtuKGIZm5f{xo~)#!bvYEYQoG{9I-TlV53_p^QrgZ9xP zf5KY#8&IzqxT zv>G7h5bdQ8E)`UIyZx$sOFzE-RJXzGfkwj9aiLK5jtPlGd_0D4)a;LL&X8;N_DdzQ z?TwP{@vdZhz3|R=mVHpNJs)-XnaKT0Q%^E4FzI~YRnWS>@#Jzv-Pcrtcr*X$QQwN2 z^7Z$k=Y#M*LTkiz^Q`u`d?FvUCwhda_BTBhTUv_T52?+2Z+Ed^`Y)47S--z{mu+9}E*Zr0Mm?oubv+3qOG2X|2}S!sq25TdmgVgm*%Rd$`+bxzGg#_chsS zEhN;dq^?%WAt1;uc|Y6rh6mG5!cDr4dyw1a9_*&v>Fx}7iK+`F7hnMtL5iCTxJvwmVAcL2JtNZuy_vtba9aL zJkK*k!MQ#80-=rKMf^?TCHynR%lKyr>D-Zgh0xhzuk$L;&Ej*(*La>o%eKI|a2}iw zBd}HUI$~tS z{3HAm?13w&!EX2o;eUnq;lJVc@CMuk55ePbCF$cSlX5~{C$E)P$*biRye-PbvPUkG-SQ~8P)goxBi;4z=kO_b4=&>y30gQEX22nk zk%!5woJEcfd4!xT4=1!-o*?_>D%mGj$`$f>-W)BDlgs2%*(;aGW92ct$;$<@AiJb1 z=gUqxk2gY2lTA4;uaQ^Eo$_+tl;kOLNH%0$o-7CD8d;Mk$*LTX6}eiL<%!CQBoCtw zpHHGQ_&VGN--M^3PP;E9)dZHJ1Y408!5nZGU_BrMx1+0Vq|3=8S|qP(vPs4|rGSc@NJ9&j)x8@jM&uC48&gORYAmZ!)@W5+FKM=R#QT*$*b=!8|!4|hXi+UwLWIqePnHu4?}X*d+xVJ75Y zj#`7@NLU5^a3Yjp0IF~j)Zk>O!x^v<&VsXHGn@k#z(w#e_&8h**TA(fuD(az=fIKh z9J~c@!#j{7emcy6Lm&_H)S3ugPy`7_!SS#K&V@_iqi{J~rRFSiHwiP~5a@*YP=QTw zCXB#VxCH(b{tP||?}MO>X^@4(U^W~91y}$*uo#YoC9nck!U<4Jp&G;;ZT?bM?endz>#niEQX`u7&sP|z*1NS$H7YIgH_NECqM~Kgw=2|oC0g% zR9FY6!Fm{m)8Py_2e!bua2}iwyWl4HB(vvJ@E33c{3U!E{t9-%-@{#SH+&WL!q?y) zxEJn+2jD^22M@u+@F+Y6kHZu2Bs>Gp!He(`ybQ0v`|t-CVb-SL{{icxPrs<8U}3B#se^EEFS| z5E4TIgaD2KmkqQ{!xg~D%l7!#e*4joF5S{&7j{W0l%|wYAe`a8&t6dIeRr=Gx(j=B zwZD1u=Dm5(&e*?s^M7-^ng7iE=g@K|nGv{B_2%8T-n#qdYDow!@7=w7?;X39obDB3 zV4zUwNGYe|SJdnEwNPK7Dxd0^=)u?V zzUaR*iTcLJ$NNOgH5&R^z3sMoCeyQF!>6_U$Fn!AUvH($6^qqsvx;+)riF=ewK~|Z zZ?GD&x6S%2BebLds<_ zuBlO@C*RXZ*)^Pq7ehajB@mjE+m*}dXCmQ!(ydg?_|W<*`thk;x2{0hjFxI5t&%rG zIiE-b{pX}RinUtPaUB2Cl}cqikw}>MJXy!B{%%qM#|ibIMpwy-SK%`GoxVuTP4xpg zXfEx^xS5obh_pV`Kt)B8q!QNO3Hn#{&(Ox<;o-GzXMDbBS=HUE|9Fs}7FL4#?x<<~ z)pl6zS1Fn?xnkvC8;)0%*ZZ9Ry|Nj;zW(Pso~zY-eN=1pbt5C|>NP)o#ki&^Z)|MS zrm(!~=;-k9(9qyuHPo*?|Gf4^>!;kNu~IUOuh(kTFn^^totVNNgzd4*A5aFc(9vPX zZ`w3A7Syj=Eap6=oAgn8sm4nx9DnVh`Dypt?@bveq5FSZCUD#I=ob5P6Kb}lCciiK z(WrOxsH*em<}ltH040AqS@tu~P&0^6Q;~69A3r+LU!ybKlGadAzTbYDowNI&X_eL^ zz^V7@3aJ4Q_J1xmUWB-!p`DQ<<%_sIH}RvJ%?L2<@inUAt?}WtUkw01f6%;iXknxJ zP{u{|v5^OK^_GY6Y5;`w^Rh3Tn@9u}!y5oiqfceN6zR}fha<4p#OmcqENKjeJ)6!> zo=@R?RvFZaZP#Dz0POzE6{F*$7?XR`5jm%axqz@ z4`na4WzSS~Y+1D~Zm+OFjp?h{zZm<|U9V55{m!Xj`@`{5jLCj|134Gdr;4}bK;K?} zTcvsV!`=wTYf3G+)Xvz4c7KAExA>zA>oE~5km~!9@n+4(k)VIW{!y~6Prv_z?*Y_?de7mL}fFV~g8EA}tf7ovZ6ZixPQrCIhQHMRS|o`KQzK=rq+|F&FIR<#Oc zFZHDM8-45jYm=VqoQ0e1ufJ+PuJYetnpdwkmF(*$NIxr3<_EF*&y4N;TCoM86;B^s z@kA@0-;Qqv3v_6GoA!Q4?N37crpD9|3q);bso6iduD3@kS@xq8tS^2GZTqW+p&E%o zba?K4@xBgpsCP#$jc#d++Ie#=*grMx9i*9&)?Tty3aokCjH!l1cW+dM&2asw7MbTI zZ(TO(iYfSmnEnHOw_+~bQET67!+tix`2w3)W}q2aB|Y94a2dbGedvDNTJHxuXK%Qh zMrGRma3DaV94oH7PM^zqdh+?6o^buur-Uq$cdYMEVBc`%)I@AQH8E|P zF5h>4{4V2KI)0lO@15rBomo}A>cl{Ba#R%z>o*Y@&E|9w98twct}QoWX%Z>d7Ro78 z;Z$V4n))(Yyl%)@Cs$MdOm}x?^8PE@9ueLA>lSv}?c1RZzzwE*fddgHbG@7}p{r?(l4*dHaA^#GucuJoJBM56ZwCPW}BabRHT{cFQlj*-h&aZ}$9 zENRT}j%Y?+Raf?)7MzC`HX0FyH)1k%G4|Cf)sk@+oq68oONPSs)7kBP?S1xoGq13^ zvAz)Och!Z4*{mJtZJsXc=t!s4fzL^0_Pf0nYJcOOCat%l*<$V@f4%Z{E3y4ZbiWdn zl~uE4mEYdKsPwj6jL8h!$oWcr&z4nwTP_wSpU2dB?_K}AXYF>X=Dx_5bFux5s(<|a zHikxTF3+sHNI=(#Ve3FabFZk!lRB!Zrk?PgEXZyUV z-kcsdgH(ik11nM`iKw1`Ba@( zIk39H{YyIQj`Qbc(^`Fz`vA&0 z3HRTsylA|76UM95(fbTPzrR0IsiX0Jem~ymKOB#~{(IBa$>(7`e(m$II)6pyYxu_W zZ*)BCH)cGmH6a?W-`L~bnopV7e9A=Yr*FiHx#;a^Y06u}DeZfkZ{Mu(rr((HrfL_B z*KbUGkUzK&)G@|IGbaZ#{mWQu#w52R8uWeTw;h*q?s=efy$bM*6F& z-Z-xqu@IBzHm9NzC3 zeTMDz`@?UqE;AgjX8kek^H+nQxy4EC4^}L_UX&)?r$+3Vl4AD{CEK1v+TRT8Yu&F| z<3p_<>B#s{rN!2tQhfah<2`$4-M?x37v8tJ`=a-6MmF|LuV0}(({gB!bo$U9A(tlY z2TJkvIJ8Gre(!@ie|1v+=>1z5Pmj_)wm!}Mk9|JP7j(QjB&qnypmpC&{_3FK9*mm% z@rr-HAKZ`A@lJUEA4#vQT`YfR)^i+Dtoo|!jzlPLAHr=9@4M~q_0eRvv))E|wMLw$G}*&ga6&`5Qv`$e_C+o893g|vu{knjwx z28cOCd+CEq1(n`zzbfC-k8eNKZ7_SFk??d}D3rZpLLw0#kKr3N`=gsP|(x6>G>&CZa^i_(b6=gbV0#=Rkm6S z3H2(etJQKya{$bOb+8^r;XcZ{9WEfe4Q}kZN8U@`&vrd5ALY5L>puAa&z)WSH!N0yW$o)W}2IDldj_);I_F3x+!J1#%HO0=i)l^oTF= zb}^wN;V6-H4{@`FuZxU3%l#ZNM~j>Bj}f28?-jow#B1^-wvioZ;pkAIxF z0Drl-5PyXj!|xLx!e1#a!tbZ_x*yFsybCdX7@>QN^)3VKQ4x9_;!3b;- zz0PaIkBZmv&ldyE8$2%%-@(679OrzO=a~2&{)fc(@h=iT!2b)e(Rq{SR&l2D7SD^t z5AiP%Z{vShyo3J{@gw|?in8-#p4&vl`3cXDiJ#(c7eB+lRBUiA6+b6*nfL|%<>Ht4 zSBPKXUnzc#zeB8ce#7%Baia5Eo>zuGW;{>m*YFJd3H}q_h5v#766)%<)%rfX1OEvB z1iRsKYOo7_M)+UhJ@{|FT!>#Z&v6V6SkhmECMm5u5ptIFV z$fTT**UD?;mGUZiId6+{vFwqHWVbv*E|iitTS<2vd>lRr@4}^gBS8zN!wfhGGV&0a zm9xmvArF(Y<)MU@$>U|eTq*nH3b|Y!$D1SNv2v+gB75aA@@RP!Z}M`1EXXeD%K5TW z&f|@c(_~YQ%d6!Ta)-Q(Hzj$p9Fh%LmnX?VxmwobiLxpOWJRu$WqE?KA<09i!{?Le z4895X!nffmsMGFCNHu|_D8UxwMKA~41y~Qrz-{PiE9r9ba5-1bA(WOgWxG6>(Dm>Y z;=c;t5YJYI$N8~Ea9psnz?_+NzG@Kv}Y zxsdp;5&9N93D3ZD@I1T%x1*IkZ~$NLgt>4pUw8oa!lSSc9)~C3Nq7!kfEUFyYVZ=F zm*Ew7RUF8h*F=VK@&@vE;JffW_yN2LZ@~}YZTK<#0{#I10UyAh;s2nMGUh`sEP-?3 zJQ#s3a4j_98G7U$$kB>9FcHLK+T+c9;n{n4?x8 zI2=|&Kb!z%7=S9A2sJnf>To)2fHUDN*aT<8`EVh81U?E^!PRgLjH~Za_c?GlJPU8a zTktldh@TEK;2_AuJhdW17ZgFl5pW!AhI8N&_%K`sSE@P7+)cs^I0!mnK2%^MoB<=S z1ullagujAMz-#(4=jeG;TTvBE8uu2!D<+UHE;@Sgfn0(TnyVm zsGb1_(r_@$g2NyObKr0|0v5xOa1l}KK3QcAZyc*eGOw@B2@OBQCVk5Bzt6# z-Af^3h>`7^-tYactM7e1=UmtQ$MbuB=lsrn&i&k=*t4g8J=8So7G}xWN*w5cs^=~s zheiiQdt20G>0|BT&3@f$b%bp@Utg=YP7+1jw#ZYv_UOag+8Qo`jPBXySykfN%Ogqs zdp8DUm@x3<{rI-N9NbLA_iaMf6kQKSNpl(0zbZj&TqLet?m6sbwkJ|c5vi-ryos}y zjJF51f*7G4Lf(;d&+(S*3>}M-Q3riB;j`3|v!oZVQ)(Q9ZR5@CrrWP?N(Le?D3B(@ z7|@o62F48x#Ip%R_{9|4kz`x%&WpH}Q=NQPMPb@a*^7MPD_L{g< zTW&C|`LOl^zq&hq|l zDh4UL^s)g}(o24ql4)2ssNM+9J3np9_Y=wlN$HnUsS#<^h^tXn+ziWCIQo@nj!$*Y zbVP!xytxOwF%g8HDfCDhMI=q*#S1R(Kdzr?y6UHe)_ zW7D@;76oqgEX2~YXG>4po2y(ma$G;Xv;qlCm@eF zL?c{A#jE{yoNRgL0M9`$=e4Q$=h*lkoR(K2kZLywmkAHMw>GOomhyb^cwXS&b|1NE zLPxQz2Z8MacpV!eO&jxG2}0>|=o~CD$GFdRdfdu&BA9W9ap&eX?p@F5qFvH&1u>lHwYHG zn4LvKW*z7LkRd;@iadZxKkP+ZI*I@#fM4ebPYG;heo)y*{5vEG$M z=prFO;gd9u?&uoPar2_g!Q;`RPl)XgxYz7=?gJ#=BZmbxJrJ8~RwpI3KpLoj^7=6k ztlAapmPq~v&TXkXA*~e9IQJHybOcNzkM7(P{}C$RGx`)!9;_0!zfFglXrh<%OB%C!a?ad$PCOYeFd+VSK7f3s{4(o}IaA6DZVq{q+M zb-->_FLb+o)G=(9`TH-oWH73B1h?Oi@mlQOPfy1oV3omHQ5L$**0kxMHrGV5BgTIR z9}!pTCP@AfoEM(nIZKD;BN^fhDuQ{U8=DL1)B0-9Lc_}^kg&wdtE12B$KPy$y=5CqrJU;TuwKA}D^@L;Dy-gG^s z1rq+dx%DTYBUYWB`i4%kE~kSDwN6 z@iRv?!eB>M1*<OwX<- zGK#|$VkuKY5$Se<$YmRkV73`NVi6Qf*5#``7b<+)hFN~oj_23OL(}$@oQfL+Mj=-2 z1pLV#Oy>RWh8a5B)WR_UP+Q03NK_RtH_S4$Qd~c*ioQ#eEl!lC^*ybOL9?Oa2Q){R zHR~&!yP;XXRYuWKJQ2P^k~YOa0kV6@{CHgJvl}2o7)6MuURVCx?D)Te;sGw~{in5?-4~^8i zmSPG^GC&GDV7S6@p}IIKdM)Urt^byN--fo`-xya*un2{bSqUB|p`JC|oBLlCMxQjTJtWJ*$@ z`BQpflyT%x)J8$s2GH1lHPQ!!lJQJ)Qd6P?*ncLymA=WwVaW^_xJcL3{uQ`vHzy>c z^kl@gbxbi09B8gO;&_2KxYMhz4=TYBubswcc2<(|$JCFBrB|qAR6xo1Mscke)e=NZ z9$RKiVdQkvyhiCay)k3pEQt`N@!-Dm4uv5J=AH|cN|~uo`n7L(*$j|X0WOl8MSMM^ z>Z$gEJNb?7i8#iO?TjCpZC-_BM>aHQ*I?6F&M1T)_BHi3HeF(A96F@gqx16HD>Z&p zj52*N%h*qG$ZUCte75zm&_1y z6yYfAWVPh{5FLAr2G({GJ|j2EBT39*k{h2 zoswBr=D9&wYN!|90V8Q{x>$1i_CrzFt%RX+s9DV0T!Q!R-;fgZ9tT~?af8u_M)oga z6}kyS%~0^Wq)Nvf=spa2HWKMn`sulyECc7mV&+le*bP5u%SZ?ClhezUuYnE&lSLt# zN@1FYFVFmu?b-NT)2H|gKX~Yw;l?&GLf%yDsSl)1ar!rm81`?Br`&V3vTfoNPsIgM zN;=tVhB!f9e16HjP)r}(Y%u@YC-;O@C7yc}A}EFE&M%@bzY%5DBO1G1{2$DBznuO$ z7eImZKcql@&qomZHzW!ID2P<79J=jUxtiIsrwZW33-V@(%U^PQw@7u(*kT+~e zGr-TJ=Tg7qLA+jN0RI%TW=amXB10yscs{y{3=T9g<%z@SU3ZQdbOL~L8CV3h2!a$Z zD;C=Ac3TlN zx#EeeQmCxbZg3s_n2m=*g6PNSBI}EDYIMJSr##2Go*`QP72W~GL*$HQ*}1}p47rRr z*Hf(O&*xUZI?n_=w>t>$(?(o?>RZDs>SfVGt#C>EuBC`aO{dG;Bm8JS&E5|l7#g<3SnYZ@L zYmrk&Z%Zy(vg!cQ*JfgZ?)?md>BLEes*$rcQa$M9*Fp8AC59dBk2UfJMYqpA{+YJ_ z0$m=n9u%SJIOj5BGKh_G0BVkOWRE%ZLRcdL!|?^icAxQ52l$O4^eE!b$ul)oV5jVG zG0#rb`F4fW+)*bT#Y)Tk>S6$)fymHCd{jTbibB zow#4tsh`d{_kKLVr7VB_^B3d&83!rY^h;~Z2PR?5VKqK?XYaccH|h0>+hGvr!q^Ie zvS?Yeo)K?TrhB2*mDQ*T>|mNwVN#s9WW!=(^?E1k$6d<8CXg-D*%^5&w>PY*8}3u_spe@^?&Z?TBzSV{hI_?c2AJuDHnrPv|f& z_Z2%Uff49Mv!2~tR}64i1S}E;f>*f#{X>dG=Sp}jylXawS2Oy!#A&fd53I#JF7l3W z=(eBMZS@ope_bsKw|OP_*Zt+e?&ezNkaAEuo6gTGe;iF<3RJ(T<^TLvl*ANam5dDV zYVR^LbD; zw=*=im#Gi`Sz6t=Csn|!6~wacg78RQJ<8IGsi!O9VfxNh!&Xz%%p>xe2PvO&zoUMK zP5#EOgLDo4sbG`XZ80XO9&-9CFfG?UfTs&2`+gwD0=re{803Y1BXTFP^J=uWsL9nm zpNy+z(n9@iTsQjxo(Jn`ojSD-NntM0bsSB(N=ZR^Youj-mw0r+Vw$O6F_oHc_p>&_ zJ=xDammj>@{2ca$Kj^qA`Ab9q(jsGl!xrnmq91p2GomXY{bpZ-WwP<)t3?rA-^_CI z0k_+>ATy>fB544W7=_Omd@5Yx&EM73wET3-8xu*DKYB1Fs3_c0WN~@?9$1V3wVqwB zPcM(wf7Gg1E74r=(EY$kOAoLdp_FaMU8#X_xZ}%LNm{8=(Jx`^QtmdK*cmXtpMq>y zC<@E9)eS;otVT|mHo;&e7G>fnAiZ_F&EMN9yb@qdUvY(0KCf>BX zDqb-Om~bkSmh9JtAI#ruoYv&mo_|`OzARR zdv?^9e3?JWemMF#(im8Lwa{mD7&~gp(~vVX@z;CoW}NZFAe7;n__$B*9#BKe7F)=K z88>+m*4(V*?Yj@%o5`edynbB7yWBL><_+I5OnR48=xCDYLZErJ6*HMp+x5VGK`-gc Y;?p#@fCabs_+y$o42RSq(^RMa1EL+$vj6}9 literal 4024 zcmZu!cT`i~(gi}3UZwX=Xi@@5Q+g32C`eHODWRH(N>h4=AiejZ^j-u3fdB#mVx+e~ zB2DR_5Fp?ef9t*V{NCfvtabjl`_Ak$v*+A4{#-#K9qa#E^WKowyhe&@9@`1L4ZJaH(1&ihp|1OIl-y5J~c6Z=yfMyv-T9+2*?ho@?> z0o6VuR0xJ@{Br4>v33=U@PI-o~gJ7XdXW5i;cCw(aT_RlJGe#~517T9%=GsmU_u-==Ds za!kSKTPw5XEm{nq+a+uh!nnNddh5-f$s>Kcicn(@pt0u`ZNo-cDtq;|65uyM-%@Yn zv|<~4UD=@5{e>Y(YcNM^@H{<*!n^k(p^GW)`J6#m%Jw_AHRiBl(E<%4;Bo>*7(fxG zqFEU7(1uh+eRepPJBT7XFhL$!RVv<)cMA}(Oct;_&7i?dwQ9wll9lf|B+)Nep>k5(1r-fmA)Y_EJN0&vFY(K+_U>eSU>gYTjmqT-!fL$%TiaB* z&1yG@fTf99V1((AejO5ymYMAwZ9$Qvtr1%DbPkQOWQy@3WBXZW6jO*a7VqkeAH-Q3 zC!cp=4?FdcN5n+9?lHNa#iWeZG)HRf;q1r0>RY?ECy<#^_VPNZhQRp*lV&mEE}Ff@ zy(Cs#cdbrLVEGq8w6dWhJ|QAL0gkF>GO0FOYzHq+zJ&)n z;Fv$0nA_-G{gHdkaPX!=MRoqI&}VZC^i^g7aeSh8)P~3K=duL4|ciSnPZlQf)GUZi3H;6+V>OvhG%l>R&3-P}q?tzIPk+SYdQjuN|MvYDI zZOZ5u39j8?1i$^y!9&%VM;@`00olPL&?rH+xVmhP{RjKwprN71+|6YqHhXyY7k*_X zvlDBp`eR>BDk>OL{odrLk(Vk|hPq|*ljj9O^%pdJKr=lO88T6kF*HEwajX5MTLH@k ziC^%e0v5?*&2yhRW{q@3w5(oCQ+7E!6`<`mq+9Q~ZGoqjq=toKV*a9Pec0}~BjS0W zZ+NDCEYjvD%ehV(Mzgwr&@`@TGTfbFAx&^G%oT!n7w4O(|~CoA5SNso$+#er(lZKa_G9W4a`P0 zQ8PO-|{FzIXOsr6OHa?lLeH)dc}UDikrvIT&~GU6!IJ^SO@ zR~*tvuZz$RMXP-~yI0oMm){~d-0KO56%R+f*Cmyc0m#XyL}gMu;hvh}@1L_$XPu!s zdbeAP@+eka(58)F;Tb%i+%()SJaDNFmQxCqQ}PaKq?mG#IIk2PKrU)Mq_RIz^c%~o zk8}DNx};wT{WuZhD9}!@v`4*EeQF+>J6hnMTZ-(T)M2RN)eIx2$3U3OWSr!DApWPd z7SJ>y`nIpy-Www`*I4g651T%;nVByQ(NYT2x@$)Bi9Xxl`ZJfrQgJaPmx+)XX)=X} z*bhIavBiHu-jE7qUsJZ%GUGrQJ|Ae3RU;jzsAeL2pEt{~b+?C)6H!=h8k#gJk%KIp zyWeZgxOnB)ZQ9!Vg{eiQo0)3RdQ{=&SS`4^_|X8c9f*WPEqCR5JueooLPFi9kgJo2p}wIRsfLpRdZrd`b(Qvk*X z;<$$oG=&f3^H(6Jukc0wN_2HJAl-zLWI)xfOUs^`V+eTk{p8eD zm#A3AkD~ZT(Tfuu74#Li>&Uu97;W<;oLJZHCzI}^j>YUcCa0Vk7|5zZ6YbDzi zIATK#UJ>inCq2gpwiqvrhzomJR_!DxLs48RQz12Xt;<&8TMWV#0_{__hiR&5p?gy`$VW$1xUQ*BA_THWBgPJZ^)zJve55bS5&p85XINUG&nIHZ-{N|nhbrbh8f=h>LoM!DVD2B%z#ao$8l-owD7lJn!Ps7yxhy6`8%=?ct&OgXK zYu=S`w$^TpEBua*12(O4ll%X-Iu1QTXQr8(MiD7WwmeU5vkk%GO>a2v*WR(1h}p8j zhTCA(=AgBlp?~EuD#6D~Ifz}~+AxYTs8XvCP z&v?F@QB{o+ytO=uOROf^C zc*qzWbv6&T_}Z9)1scVimi>nRsLa;|u?83;`d54XZtKMggDgd06-lKMPgUH@`|SFa z1pc=C6L?uRW4+FvuMdZ5nc&f#<&g>(aV{v~pMRw8O5Lw(6?N}UYKu7aylJ;xZK27P z7g_ihDWII4dWWu_zP`SLUAL7TrjT;KxAlNtK|6|$Pt)CUqUh=G!G}|PH$#ZObEG|T z@MZrvo%s#&88m;2jMY%?TA&lr$K>?2B}?Sughz55S?SlM;QWx=oPmve`ymoJs)bgV zs=gYL+bbG^^SC#4^|y*d+lr^ST)X4BJa=mqCq|4t2drw&neE;UEdAbb@V4V#U|MVK z&yeIkWwbZxDBS<1WAg0Hbjc)0tc^O^Lm2qs)lCk6c&J0C)5@WqV3CY)lYqgG2Vwh1 z7jM4da#rkaI4fv)4@w&FINzsinJ_d2nXqD&w}sp=<9W~|3Ci`9&(%C0<>i1cnnSDrACL8bQG*ej73xV{rnR0LUdDXvDeDhb%_$LeJ!buq0EmIh`H zF7@=3S!BI2H^1BIFkfOd*JPzt+%Yif%H`0&H?NnPtt>MpdL{>6`ca61o0}PBo4Ywr zcV_gO+{W$R#Jc86m%5JH;6eV*@`vm5aH zv)wFM=c?Z8Jja_Aj`7bwyFIZVVXtkCd#B@-tzy-Jj#Fd?UC@@W?B&U#2nqfVTx-qO diff --git a/console-setup/cached_Uni2-Fixed16.psf.gz b/console-setup/cached_Uni2-Fixed16.psf.gz index 52c26d4e6dc09ed8053b89d4ae8bc437dbbd36b6..37eb6549a069e3ac743378f24abac3ea0d6f36d2 100644 GIT binary patch literal 4151 zcmV-75XkQziwFP!0000219h1RcwEJOz{k4}u{MjmUW8ejwfwZ+F|rI;HpZ64vR*A~ zu`7(R1vX#|$O05h;D7A&SMx`8_vb0;zneXQBsR z$NQrH&Lrv^A0O`%G1qA5XZ7~m>zPc?#*LrW^6$^txM72pE>|p8tIaCTNtzZW%GK&% zzmgL(6N&yo6+753#Bnth>pM>$)*D|x6RE(V9Z|jp*FQtKcE9ur8A=J2zL>Mq>(Z)` z^1U|qM3jTjled+Xa+;1MXWXWnF+y0Ps(-Y82}j3AUA5Zs^&zHorn0(91za>fo6R4h=0&rDiW$G^ph~CFEDFsSd6(rALZ$QmKsRQYlBtt_mra z$+)IQjh=i@BW2fcB3=yrOqM`sPHtB&r=N+0_er->G2=t)ujt38a^1QDWiwi;iL^@I z4CQxfe<$c))jvabtY1 z^;g?zwO^%Z#^j2Xe_c3URbKCN{`bme`1<;v?|80O^Yu}!)z^=VtgqMn^cCZpro6GS z&6~sWs-vUB!$U)ZgVj*K_WbkO7p15f@Kts(SK21f&b$$HkM1PIWbW2)8LHU0BX?D);f2LJh zj{v9Mt1F}iK-mAe*mx1*%7%7Ej+8Ir_T0peZZRXkw8z(|inqpx*M2ns{QN=l(xHWo z>O&b9)yGC2(A8TJ#;XAk*3ZknaBdtx$`BJ1qYaNcjUK6XAC$Y3K81`&B zJ9$2Z^I2t3E4E#KwF9vGGgpj`k77*jO-JOMvZ|5sWQ`y7JzZW{elaHN@}lwf_{ha% zl|Gcc)RsL{)v;yOy12c<0yU>WQ&rsFn=MJ=AR94WRjfK%-cX!9!LT#NTXJ_}U zt6JsR`Lo$#v0f}@v%Xwc0OV8K_iM!#gjPI# zbj1^`cz!#+87$DD^=;bwA+)IW58wn8uy|5acjLF@SMHj zZW@(o`@?|%jdHBG{(5~b>*>kodwRn4SDzwQ^tj%JexhKUwcoM6KY@M2l~WV3{nW&? zX}Wyh`SH7rYw7syX1sTruXkou^{NvC!O2loFs$E1WHg)8MQ}tFBe}NRh^0xSTw5ro zOodaC`D*IRXz{usXPsP4{WIO&naTUFXnRC-^RHXjX}52uHUKx8{&n4Qbf2ePAo~Ww zw-38-zWL49AGl}Nu3g?{EMk9@T-F1CKDx?pE)$8~8<-G*ti*wVsrRo9UpYoDTg6R% zKd`hh!#koGd39acgIaJNTG(hr6yAu*)Wz6WuT)FMU3}L0TP__6+fQe=_qF%g>&?8v zn#P7gu-{b|8fLS0u(x@-yrUzXRtG*Ol{w({TB!Yvf10%3j%JIwi~aS=+pWa*Bhmdz zR905amQ{Xx|Dw{{axo?|Y$N9@^*viw`E9vaoO~Wr=e_s*^PaWashayDTh7JyGphda z^Ot84!($4kgTbMp;o;H3mWs7o3d^s?%8%`jDiu}1+D_lz>Mw@-n`P;af|5*nt45|i ziIT2BsbcSUg8jJbmKg5E?q1dhvZ?U3YLiHRn@x zUgf~*2KO)NtUJ!1n@wx=MeZNGR)_uPk1y-~LBBEQQKPRg-q)8OuTGHmeFd?T&adHo zNwr1KvzfG~-N<>t|Du0BVVQ{BM_9XQJ)d&XcqPZruayeN+x_8rB$t|z_Kb)>U!(hL z^(NeZtMa1p>P;B0Qb+GI{QUm@Or?&-`}zHNqyKO``ugupS0|r`_4u{V$LjnQov+~= z)4$R2tlyaNtk#5RynbVkcWXXnV)H2zt)IRTE9RoNqopZt4X3p4ZN7c8#+!a)#+#~L zG+w_k@j?FJK8!b({Rr|0@w~C(jr}wCXTA0KeM;qbfgIcbg!d`t`(c0j_4nh6!;zZu!sGrfL=_Dsv6J<{nzdxTt? zv>zzN*W=J0S^2#W>ipG7`J?x5VLUxb_t^S0_doXeG+)s1>X4-3D}&a3Gx@87dV4Tx z?#CkwB-HN(W`DeP zczAdR4Erm++U%6Q6OgwW=UtuKGIZm5f{xo~)#!bvYEYQoG{9I-TlV53_p^QrgZ9xP zf5KY#8&IzqxT zv>G7h5bdQ8E)`UIyZx$sOFzE-RJXzGfkwj9aiLK5jtPlGd_0D4)a;LL&X8;N_DdzQ z?TwP{@vdZhz3|R=mVHpNJs)-XnaKT0Q%^E4FzI~YRnWS>@#Jzv-Pcrtcr*X$QQwN2 z^7Z$k=Y#M*LTkiz^Q`u`d?FvUCwhda_BTBhTUv_T52?+2Z+Ed^`Y)47S--z{mu+9}E*Zr0Mm?oubv+3qOG2X|2}S!sq25TdmgVgm*%Rd$`+bxzGg#_chsS zEhN;dq^?%WAt1;uc|Y6rh6mG5!cDr4dyw1a9_*&v>Fx}7iK+`F7hnMtL5iCTxJvwmVAcL2JtNZuy_vtba9aL zJkK*k!MQ#80-=rKMf^?TCHynR%lKyr>D-Zgh0xhzuk$L;&Ej*(*La>o%eKI|a2}iw zBd}HUI$~tS z{3HAm?13w&!EX2o;eUnq;lJVc@CMuk55ePbCF$cSlX5~{C$E)P$*biRye-PbvPUkG-SQ~8P)goxBi;4z=kO_b4=&>y30gQEX22nk zk%!5woJEcfd4!xT4=1!-o*?_>D%mGj$`$f>-W)BDlgs2%*(;aGW92ct$;$<@AiJb1 z=gUqxk2gY2lTA4;uaQ^Eo$_+tl;kOLNH%0$o-7CD8d;Mk$*LTX6}eiL<%!CQBoCtw zpHHGQ_&VGN--M^3PP;E9)dZHJ1Y408!5nZGU_BrMx1+0Vq|3=8S|qP(vPs4|rGSc@NJ9&j)x8@jM&uC48&gORYAmZ!)@W5+FKM=R#QT*$*b=!8|!4|hXi+UwLWIqePnHu4?}X*d+xVJ75Y zj#`7@NLU5^a3Yjp0IF~j)Zk>O!x^v<&VsXHGn@k#z(w#e_&8h**TA(fuD(az=fIKh z9J~c@!#j{7emcy6Lm&_H)S3ugPy`7_!SS#K&V@_iqi{J~rRFSiHwiP~5a@*YP=QTw zCXB#VxCH(b{tP||?}MO>X^@4(U^W~91y}$*uo#YoC9nck!U<4Jp&G;;ZT?bM?endz>#niEQX`u7&sP|z*1NS$H7YIgH_NECqM~Kgw=2|oC0g% zR9FY6!Fm{m)8Py_2e!bua2}iwyWl4HB(vvJ@E33c{3U!E{t9-%-@{#SH+&WL!q?y) zxEJn+2jD^22M@u+@F+Y6kHZu2Bs>Gp!He(`ybQ0v`|t-CVb-SL{{icxPrs<8U}3B#se^EEFS| z5E4TIgaD2KmkqQ{!xg~D%l7!#e*4joF5S{&7j{W0l%|wYAe`a8&t6dIeRr=Gx(j=B zwZD1u=Dm5(&e*?s^M7-^ng7iE=g@K|nGv{B_2%8T-n#qdYDow!@7=w7?;X39obDB3 zV4zUwNGYe|SJdnEwNPK7Dxd0^=)u?V zzUaR*iTcLJ$NNOgH5&R^z3sMoCeyQF!>6_U$Fn!AUvH($6^qqsvx;+)riF=ewK~|Z zZ?GD&x6S%2BebLds<_ zuBlO@C*RXZ*)^Pq7ehajB@mjE+m*}dXCmQ!(ydg?_|W<*`thk;x2{0hjFxI5t&%rG zIiE-b{pX}RinUtPaUB2Cl}cqikw}>MJXy!B{%%qM#|ibIMpwy-SK%`GoxVuTP4xpg zXfEx^xS5obh_pV`Kt)B8q!QNO3Hn#{&(Ox<;o-GzXMDbBS=HUE|9Fs}7FL4#?x<<~ z)pl6zS1Fn?xnkvC8;)0%*ZZ9Ry|Nj;zW(Pso~zY-eN=1pbt5C|>NP)o#ki&^Z)|MS zrm(!~=;-k9(9qyuHPo*?|Gf4^>!;kNu~IUOuh(kTFn^^totVNNgzd4*A5aFc(9vPX zZ`w3A7Syj=Eap6=oAgn8sm4nx9DnVh`Dypt?@bveq5FSZCUD#I=ob5P6Kb}lCciiK z(WrOxsH*em<}ltH040AqS@tu~P&0^6Q;~69A3r+LU!ybKlGadAzTbYDowNI&X_eL^ zz^V7@3aJ4Q_J1xmUWB-!p`DQ<<%_sIH}RvJ%?L2<@inUAt?}WtUkw01f6%;iXknxJ zP{u{|v5^OK^_GY6Y5;`w^Rh3Tn@9u}!y5oiqfceN6zR}fha<4p#OmcqENKjeJ)6!> zo=@R?RvFZaZP#Dz0POzE6{F*$7?XR`5jm%axqz@ z4`na4WzSS~Y+1D~Zm+OFjp?h{zZm<|U9V55{m!Xj`@`{5jLCj|134Gdr;4}bK;K?} zTcvsV!`=wTYf3G+)Xvz4c7KAExA>zA>oE~5km~!9@n+4(k)VIW{!y~6Prv_z?*Y_?de7mL}fFV~g8EA}tf7ovZ6ZixPQrCIhQHMRS|o`KQzK=rq+|F&FIR<#Oc zFZHDM8-45jYm=VqoQ0e1ufJ+PuJYetnpdwkmF(*$NIxr3<_EF*&y4N;TCoM86;B^s z@kA@0-;Qqv3v_6GoA!Q4?N37crpD9|3q);bso6iduD3@kS@xq8tS^2GZTqW+p&E%o zba?K4@xBgpsCP#$jc#d++Ie#=*grMx9i*9&)?Tty3aokCjH!l1cW+dM&2asw7MbTI zZ(TO(iYfSmnEnHOw_+~bQET67!+tix`2w3)W}q2aB|Y94a2dbGedvDNTJHxuXK%Qh zMrGRma3DaV94oH7PM^zqdh+?6o^buur-Uq$cdYMEVBc`%)I@AQH8E|P zF5h>4{4V2KI)0lO@15rBomo}A>cl{Ba#R%z>o*Y@&E|9w98twct}QoWX%Z>d7Ro78 z;Z$V4n))(Yyl%)@Cs$MdOm}x?^8PE@9ueLA>lSv}?c1RZzzwE*fddgHbG@7}p{r?(l4*dHaA^#GucuJoJBM56ZwCPW}BabRHT{cFQlj*-h&aZ}$9 zENRT}j%Y?+Raf?)7MzC`HX0FyH)1k%G4|Cf)sk@+oq68oONPSs)7kBP?S1xoGq13^ zvAz)Och!Z4*{mJtZJsXc=t!s4fzL^0_Pf0nYJcOOCat%l*<$V@f4%Z{E3y4ZbiWdn zl~uE4mEYdKsPwj6jL8h!$oWcr&z4nwTP_wSpU2dB?_K}AXYF>X=Dx_5bFux5s(<|a zHikxTF3+sHNI=(#Ve3FabFZk!lRB!Zrk?PgEXZyUV z-kcsdgH(ik11nM`iKw1`Ba@( zIk39H{YyIQj`Qbc(^`Fz`vA&0 z3HRTsylA|76UM95(fbTPzrR0IsiX0Jem~ymKOB#~{(IBa$>(7`e(m$II)6pyYxu_W zZ*)BCH)cGmH6a?W-`L~bnopV7e9A=Yr*FiHx#;a^Y06u}DeZfkZ{Mu(rr((HrfL_B z*KbUGkUzK&)G@|IGbaZ#{mWQu#w52R8uWeTw;h*q?s=efy$bM*6F& z-Z-xqu@IBzHm9NzC3 zeTMDz`@?UqE;AgjX8kek^H+nQxy4EC4^}L_UX&)?r$+3Vl4AD{CEK1v+TRT8Yu&F| z<3p_<>B#s{rN!2tQhfah<2`$4-M?x37v8tJ`=a-6MmF|LuV0}(({gB!bo$U9A(tlY z2TJkvIJ8Gre(!@ie|1v+=>1z5Pmj_)wm!}Mk9|JP7j(QjB&qnypmpC&{_3FK9*mm% z@rr-HAKZ`A@lJUEA4#vQT`YfR)^i+Dtoo|!jzlPLAHr=9@4M~q_0eRvv))E|wMLw$G}*&ga6&`5Qv`$e_C+o893g|vu{knjwx z28cOCd+CEq1(n`zzbfC-k8eNKZ7_SFk??d}D3rZpLLw0#kKr3N`=gsP|(x6>G>&CZa^i_(b6=gbV0#=Rkm6S z3H2(etJQKya{$bOb+8^r;XcZ{9WEfe4Q}kZN8U@`&vrd5ALY5L>puAa&z)WSH!N0yW$o)W}2IDldj_);I_F3x+!J1#%HO0=i)l^oTF= zb}^wN;V6-H4{@`FuZxU3%l#ZNM~j>Bj}f28?-jow#B1^-wvioZ;pkAIxF z0Drl-5PyXj!|xLx!e1#a!tbZ_x*yFsybCdX7@>QN^)3VKQ4x9_;!3b;- zz0PaIkBZmv&ldyE8$2%%-@(679OrzO=a~2&{)fc(@h=iT!2b)e(Rq{SR&l2D7SD^t z5AiP%Z{vShyo3J{@gw|?in8-#p4&vl`3cXDiJ#(c7eB+lRBUiA6+b6*nfL|%<>Ht4 zSBPKXUnzc#zeB8ce#7%Baia5Eo>zuGW;{>m*YFJd3H}q_h5v#766)%<)%rfX1OEvB z1iRsKYOo7_M)+UhJ@{|FT!>#Z&v6V6SkhmECMm5u5ptIFV z$fTT**UD?;mGUZiId6+{vFwqHWVbv*E|iitTS<2vd>lRr@4}^gBS8zN!wfhGGV&0a zm9xmvArF(Y<)MU@$>U|eTq*nH3b|Y!$D1SNv2v+gB75aA@@RP!Z}M`1EXXeD%K5TW z&f|@c(_~YQ%d6!Ta)-Q(Hzj$p9Fh%LmnX?VxmwobiLxpOWJRu$WqE?KA<09i!{?Le z4895X!nffmsMGFCNHu|_D8UxwMKA~41y~Qrz-{PiE9r9ba5-1bA(WOgWxG6>(Dm>Y z;=c;t5YJYI$N8~Ea9psnz?_+NzG@Kv}Y zxsdp;5&9N93D3ZD@I1T%x1*IkZ~$NLgt>4pUw8oa!lSSc9)~C3Nq7!kfEUFyYVZ=F zm*Ew7RUF8h*F=VK@&@vE;JffW_yN2LZ@~}YZTK<#0{#I10UyAh;s2nMGUh`sEP-?3 zJQ#s3a4j_98G7U$$kB>9FcHLK+T+c9;n{n4?x8 zI2=|&Kb!z%7=S9A2sJnf>To)2fHUDN*aT<8`EVh81U?E^!PRgLjH~Za_c?GlJPU8a zTktldh@TEK;2_AuJhdW17ZgFl5pW!AhI8N&_%K`sSE@P7+)cs^I0!mnK2%^MoB<=S z1ullagujAMz-#(4=jeG;TTvBE8uu2!D<+UHE;@Sgfn0(TnyVm zsGb1_(r_@$g2NyObKr0|0v5xOa1/dev/null 2>/dev/null; then for i in /dev/vcs[0-9]*; do { : - setfont '/etc/console-setup/cached_Uni2-Fixed16.psf.gz' + setfont '/usr/share/consolefonts/Uni2-Fixed16.psf.gz' } < /dev/tty${i#/dev/vcs} > /dev/tty${i#/dev/vcs} done fi diff --git a/console-setup/cached_setup_keyboard.sh b/console-setup/cached_setup_keyboard.sh index 6b2a327b3..30b46c1b7 100755 --- a/console-setup/cached_setup_keyboard.sh +++ b/console-setup/cached_setup_keyboard.sh @@ -10,4 +10,4 @@ kbd_mode '-u' < '/dev/tty3' kbd_mode '-u' < '/dev/tty4' kbd_mode '-u' < '/dev/tty5' kbd_mode '-u' < '/dev/tty6' -loadkeys '/run/tmpkbd.IpwUxQ' > '/dev/null' +loadkeys '/etc/console-setup/cached_UTF-8_del.kmap.gz' > '/dev/null' diff --git a/cron.d/certbot b/cron.d/certbot index 89f77c2e7..e38dbb902 100644 --- a/cron.d/certbot +++ b/cron.d/certbot @@ -5,6 +5,12 @@ # Eventually, this will be an opportunity to validate certificates # haven't been revoked, etc. Renewal will only occur if expiration # is within 30 days. +# +# Important Note! This cronjob will NOT be executed if you are +# running systemd as your init system. If you are running systemd, +# the cronjob.timer function takes precedence over this cronjob. For +# more details, see the systemd.timer manpage, or use systemctl show +# certbot.timer. SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin diff --git a/cron.d/e2scrub_all b/cron.d/e2scrub_all new file mode 100644 index 000000000..711b0b296 --- /dev/null +++ b/cron.d/e2scrub_all @@ -0,0 +1,2 @@ +30 3 * * 0 root test -e /run/systemd/system || SERVICE_MODE=1 /usr/lib/x86_64-linux-gnu/e2fsprogs/e2scrub_all_cron +10 3 * * * root test -e /run/systemd/system || SERVICE_MODE=1 /sbin/e2scrub_all -A -r diff --git a/cron.daily/aide b/cron.daily/aide index 767ba61f1..416333dde 100755 --- a/cron.daily/aide +++ b/cron.daily/aide @@ -3,23 +3,25 @@ set -e set -C +shopt -u checkwinsize + # trap handler FQDN="$(hostname -f)" if [ -z "$FQDN" ]; then - echo >&2 "error determining FQDN: hostname -f does not give output" - hostname -f >&2 - exit 1 + echo >&2 "error determining FQDN: hostname -f does not give output" + hostname -f >&2 + exit 1 fi traphandler() { - trap - INT ERR - if [ -n "${LOCKED:-}" ]; then - # we have the lock, - pidof aide | xargs --no-run-if-empty kill -9 - fi - onexit signal $1 - return 0 + trap - INT ERR + if [ -n "${LOCKED:-}" ]; then + # we have the lock, + pidof aide | xargs --no-run-if-empty kill -9 + fi + onexit signal "$1" + return 0 } trap ' traphandler INT; trap - INT ERR' INT trap ' traphandler ERR; trap - INT ERR' ERR @@ -27,7 +29,7 @@ trap ' traphandler ERR; trap - INT ERR' ERR # bail if no aide binary found if ! [ -f "/usr/bin/aide" ] && ! [ -f "/usr/sbin/aide" ]; then - exit 0 + exit 0 fi # default variables @@ -43,27 +45,27 @@ LOCKFILE="$TMPBASE/cron.daily.lock" TMPDIRIN="$TMPBASE/cron.daily" USE_SAVELOG="" if command -v savelog > /dev/null; then - USE_SAVELOG="1" + USE_SAVELOG="1" fi AIDEARGS="-V4" MAILSUBJ="Daily AIDE report for $FQDN" -DATE="$(date +"%Y-%m-%d %H:%M")" BEGINSTAMP="$(date +"%Y-%m-%d %H:%M:%S")" # make sure $TMPBASE exists if ! [ -d "$TMPBASE" ]; then - mkdir -p $TMPBASE - chown root:root $TMPBASE - chmod 600 $TMPBASE + mkdir -p $TMPBASE + chown root:root $TMPBASE + chmod 600 $TMPBASE fi # have /etc/default/aide override variables if [ -f "/etc/default/aide" ]; then - . "/etc/default/aide" + #shellcheck disable=1091 + . "/etc/default/aide" fi # from here on, we're going to bail on unbound variables @@ -101,13 +103,13 @@ ONEXIT="" # silent implies quiet if [ "$SILENTREPORTS" = "yes" ]; then - QUIETREPORTS="yes" + QUIETREPORTS="yes" fi # Get the database's date DATABASEDATE="" -if [ -f $DATABASE ]; then - DATABASEDATE="$(stat -c %y $DATABASE | sed -e "s/\..*//")" +if [ -f "$DATABASE" ]; then + DATABASEDATE="$(stat -c %y "$DATABASE" | sed -e "s/\\..*//")" fi # Force TRUNCATEDETAILS when filter updates/installations @@ -118,482 +120,557 @@ fi # functions mytempfile() { - NAME="$1" - echo "$TMPDIR/$NAME" - touch "$TMPDIR/$NAME" + NAME="$1" + echo "$TMPDIR/$NAME" + touch "$TMPDIR/$NAME" } frame() { - WIDTH=78 - STARS="*******************************************************************************" - SPACES=" " - printf "%s\n" "${STARS:1:$WIDTH}" - while read line ; do - HALF="${SPACES:1:$((($WIDTH-${#line})/2))}" - LINE="$HALF$line$SPACES" - printf "*%s*\n" "${LINE:1:$(($WIDTH-2))}" - done - printf "%s\n" "${STARS:1:$WIDTH}" + WIDTH=78 + STARS="*******************************************************************************" + SPACES=" " + printf "%s\\n" "${STARS:1:$WIDTH}" + while read -r line ; do + HALF="${SPACES:1:$(((WIDTH-${#line})/2))}" + LINE="$HALF$line$SPACES" + printf "*%s*\\n" "${LINE:1:$((WIDTH-2))}" + done + printf "%s\\n" "${STARS:1:$WIDTH}" } onexit() { - if [ "$ONEXIT" = "running" ]; then - return 1 - fi - - ONEXIT="running" - - local LOGHEAD - local MAILHEAD - - CRONEXITHOOKPARM="$1" - case "$1" in - signal) - LOGHEAD="$(printf "terminated with signal %s" "$2")" - MAILHEAD="$(printf "The cron job was terminated with signal %s" "$2")" - ;; - fatal) - LOGHEAD="$(printf "terminated by fatal error.")" - MAILHEAD="$(printf "The cron job was terminated by a fatal error.")" - ;; - nolock) - LOGHEAD="$(printf "terminated because lock %s could not be obtained." "$LOCKFILE")" - MAILHEAD="$(printf "The cron job was terminated because lock %s could not be obtained." "$LOCKFILE")" - ;; - cantmovetmp) - LOGHEAD="$(printf "terminated: Cannot move away %s." "$TMPDIRIN")" - MAILHEAD="$(printf "The cron job was terminated: Cannot move away %s." "$TMPDIRIN")" - ;; - nohook) - LOGHEAD="$(printf "terminated: CRONEXITHOOK set to %s which is not executeable." "$CRONEXITHOOK")" - MAILHEAD="$(printf "The cron job was terminated: CRONEXITHOOK set to %s which is not executeable." "$CRONEXITHOOK")" - ;; - cantcreatetmp) - LOGHEAD="$(printf "terminated: Cannot create temporary directory %s." "$TMPDIRIN")" - MAILHEAD="$(printf "The cron job was terminated: Cannot create temporary directory %s." "$TMPDIRIN")" - ;; - success) - ;; - *) - LOGHEAD="$(printf "wrong parameter (\"%s\") to onexit." "$1")" - MAILHEAD="$(printf "The cron job was terminated for unknown reasons, and a wrong parameter (\"%s\")was given to onexit." "$1")" - CRONEXITHOOKPARM="unknown" - ;; - esac - - if [ -z "${TMPDIR:-}" ] || [ -z "${MAILFILE:-}" ]; then - # we are being called so early that we are not yet fully initialized - # LOGHEAD goes to syslog instead of LOGFILE since we do not know - # what's up with LOGFILE - logger -t aide-cron-daily "$LOGHEAD" - if [ "$SILENTREPORTS" != "yes" ]; then - echo "$MAILHEAD" | mail -s "premature termination - $MAILSUBJ" "$MAILTO" + if [ "$ONEXIT" = "running" ]; then + return 1 fi - CRONEXITHOOKPARM="early-$CRONEXITHOOKPARM" - else - # we are being called after the cron job was properly set up. - # Do the full works. - if [ "$USE_SAVELOG" = "1" ] || [ "$USE_SAVELOG" = "yes" ]; then - savelog -t -g adm -m 640 -u root -c 7 "$LOGFILE" > /dev/null + ONEXIT="running" + + local LOGHEAD + local MAILHEAD + + CRONEXITHOOKPARM="$1" + case "$1" in + signal) + LOGHEAD="$(printf "terminated with signal %s" "$2")" + MAILHEAD="$(printf "The cron job was terminated with signal %s" "$2")" + ;; + fatal) + LOGHEAD="$(printf "terminated by fatal error.")" + MAILHEAD="$(printf "The cron job was terminated by a fatal error.")" + ;; + nolock) + LOGHEAD="$(printf "terminated because lock %s could not be obtained." "$LOCKFILE")" + MAILHEAD="$(printf "The cron job was terminated because lock %s could not be obtained." "$LOCKFILE")" + ;; + cantmovetmp) + LOGHEAD="$(printf "terminated: Cannot move away %s." "$TMPDIRIN")" + MAILHEAD="$(printf "The cron job was terminated: Cannot move away %s." "$TMPDIRIN")" + ;; + nohook) + LOGHEAD="$(printf "terminated: CRONEXITHOOK set to %s which is not executeable." "$CRONEXITHOOK")" + MAILHEAD="$(printf "The cron job was terminated: CRONEXITHOOK set to %s which is not executeable." "$CRONEXITHOOK")" + ;; + cantcreatetmp) + LOGHEAD="$(printf "terminated: Cannot create temporary directory %s." "$TMPDIRIN")" + MAILHEAD="$(printf "The cron job was terminated: Cannot create temporary directory %s." "$TMPDIRIN")" + ;; + success) + ;; + *) + LOGHEAD="$(printf "wrong parameter (\"%s\") to onexit." "$1")" + MAILHEAD="$(printf "The cron job was terminated for unknown reasons, and a wrong parameter (\"%s\")was given to onexit." "$1")" + CRONEXITHOOKPARM="unknown" + ;; + esac + + if [ -z "${TMPDIR:-}" ] || [ -z "${MAILFILE:-}" ]; then + # we are being called so early that we are not yet fully initialized + # LOGHEAD goes to syslog instead of LOGFILE since we do not know + # what's up with LOGFILE + logger -t aide-cron-daily "$LOGHEAD" + if [ "$SILENTREPORTS" != "yes" ]; then + echo "$MAILHEAD" | mail -s "premature termination - $MAILSUBJ" "$MAILTO" + fi + CRONEXITHOOKPARM="early-$CRONEXITHOOKPARM" else - LOGFILEWDATE="${LOGFILE}-$(date +%Y%m%d-%H%M%S)" - ln -sf $LOGFILEWDATE $LOGFILE - LOGFILE="${LOGFILEWDATE}" - fi - - printf >> "$MAILFILE" \ -"This is an automated report generated by the Advanced Intrusion Detection -Environment on %s started at %s.\n\n" "$FQDN" "$BEGINSTAMP" - - printf >> "$LOGFILE" \ -"aide run on %s started at %s.\n" "$FQDN" "$BEGINSTAMP" - - if [ -n "${LOGHEAD:-}" ]; then - printf "$LOGHEAD\n" | frame >> "$LOGFILE" - printf "\n" >> "$LOGFILE" - fi - if [ -n "${MAILHEAD:-}" ]; then - printf "$MAILHEAD\n" | frame >> "$MAILFILE" - printf "\n\n" >> "$MAILFILE" - fi + # we are being called after the cron job was properly set up. + # Do the full works. - # report about AIDE's return value - - if [ -n "${ARETVAL:-}" ]; then - ARETEXPL="" - ARETERR="" - PREFIX="$(printf "AIDE returned with exit code %d." "$ARETVAL")" - case "$ARETVAL" in - -1) - PREFIX="" - ARETERR="the cron job was interrupted before AIDE could return an exit code.";; - 0) - PREFIX="AIDE returned with a zero exit code." - ARETEXPL="No changes detected!";; - 1) - ARETEXPL="Added entries detected!";; - 2) - ARETEXPL="Removed entries detected!";; - 3) - ARETEXPL="Added and removed entries detected!";; - 4) - ARETEXPL="Changed entries detected!";; - 5) - ARETEXPL="Added and changed entries detected!";; - 6) - ARETEXPL="Removed and changed entries detected!";; - 7) - ARETEXPL="Added, removed and changed entries detected!";; - 14) - ARETERR="Error writing!";; - 15) - ARETERR="Invalid Argument!";; - 16) - ARETERR="Unimplemented function!";; - 17) - ARETERR="Invalid configuration!";; - 18) - ARETERR="Input/Output error!";; - *) - ARETERR="$(printf "AIDE returned an unknown non-zero exit value\nexit value is %d\n\n" "$ARETVAL")";; - esac - if [ -n "$ARETEXPL" ]; then - echo "$PREFIX $ARETEXPL" >> "$MAILFILE" - echo "$PREFIX $ARETEXPL" >> "$LOGFILE" - fi - if [ -n "$ARETERR" ]; then - echo "$PREFIX $ARETERR" | frame >> "$MAILFILE" - echo "$PREFIX $ARETERR" | frame >> "$LOGFILE" - fi - unset ARETEXPL - unset ARETERR - unset PREFIX - else - ARETEXPL="ARETVAL not initialized. cron job was aborted prematurely." - ARETVAL=255 - echo $ARETEXPL | frame >> "$LOGFILE" - echo $ARETEXPL | frame >> "$MAILFILE" - unset ARETEXPL - printf "\n" >> "$LOGFILE" - printf "\n\n" >> "$MAILFILE" - fi + if [ "$USE_SAVELOG" = "1" ] || [ "$USE_SAVELOG" = "yes" ]; then + savelog -t -g adm -m 640 -u root -c 7 "$LOGFILE" > /dev/null + else + LOGFILEWDATE="${LOGFILE}-$(date +%Y%m%d-%H%M%S)" + ln -sf "$LOGFILEWDATE" "$LOGFILE" + LOGFILE="${LOGFILEWDATE}" + fi - # script errors + printf >> "$MAILFILE" \ + "This is an automated report generated by the Advanced Intrusion Detection environment on %s started at %s.\\n\\n" "$FQDN" "$BEGINSTAMP" - if [ -n "${ERRORLOG:-}" ] && [ -s "$ERRORLOG" ]; then - printf "script errors\n" | frame >> "$MAILFILE" - < "$ERRORLOG" cat >> "$MAILFILE" - printf "End of script errors\n\n" >> "$MAILFILE" + printf >> "$LOGFILE" \ + "aide run on %s started at %s.\\n" "$FQDN" "$BEGINSTAMP" - printf "script errors\n" | frame >> "$LOGFILE" - < "$ERRORLOG" cat >> "$LOGFILE" - printf "End of script errors\n" >> "$LOGFILE" - fi + if [ -n "${LOGHEAD:-}" ]; then + printf "%s\\n" "$LOGHEAD" | frame >> "$LOGFILE" + printf "\\n" >> "$LOGFILE" + fi + if [ -n "${MAILHEAD:-}" ]; then + printf "%s\\n" "$MAILHEAD" | frame >> "$MAILFILE" + printf "\\n\\n" >> "$MAILFILE" + fi - # aide post run information + # report about AIDE's return value + + PRINTED="" + FIGLETTEXT="" + if [ -n "${ARETVAL:-}" ]; then + ARETEXPL="" + ARETERR="" + PREFIX="$(printf "AIDE returned with exit code %d." "$ARETVAL")" + case "$ARETVAL" in + -1) + PREFIX="" + ARETERR="the cron job was interrupted before AIDE could return an exit code." + FIGLETTEXT="interrupt" + ;; + 0) + PREFIX="AIDE returned with a zero exit code." + ARETEXPL="No changes detected!" + FIGLETTEXT="unchanged" + ;; + 1) + ARETEXPL="Added entries detected!" + FIGLETTEXT="add" + ;; + 2) + ARETEXPL="Removed entries detected!" + FIGLETTEXT="rem" + ;; + 3) + ARETEXPL="Added and removed entries detected!" + FIGLETTEXT="add rem" + ;; + 4) + ARETEXPL="Changed entries detected!" + FIGLETTEXT="chg" + ;; + 5) + ARETEXPL="Added and changed entries detected!" + FIGLETTEXT="add chg" + ;; + 6) + ARETEXPL="Removed and changed entries detected!" + FIGLETTEXT="rem chg" + ;; + 7) + ARETEXPL="Added, removed and changed entries detected!" + FIGLETTEXT="add rem chg" + ;; + 14) + ARETERR="Error writing!" + FIGLETTEXT="$ARETERR" + ;; + 15) + ARETERR="Invalid Argument!" + FIGLETTEXT="EINVAL" + ;; + 16) + ARETERR="Unimplemented function!" + FIGLETTEXT="unimplemented" + ;; + 17|255) + ARETERR="Invalid configuration!" + FIGLETTEXT="invalid config" + ;; + 18) + ARETERR="Input/Output error!" + FIGLETTEXT="EIO" + ;; + 250) + ARETERR="executable aide not found" + FIGLETTEXT="no executable" + ;; + 251) + ARETERR="cannot obtain lock" + FIGLETTEXT="no lock" + ;; + *) + ARETERR="$(printf "AIDE returned an unknown non-zero exit value\\nexit value is %d\\n\\n" "$ARETVAL")" + FIGLETTEXT="unknown error" + ;; + esac + if [ -n "$ARETEXPL" ]; then + printf "%s %s\\n" "$PREFIX" "$ARETEXPL" >> "$MAILFILE" + printf "%s %s\\n" "$PREFIX" "$ARETEXPL" >> "$LOGFILE" + PRINTED=1 + fi + if [ -n "$ARETERR" ]; then + printf "%s %s\\n" "$PREFIX" "$ARETERR" | frame >> "$MAILFILE" + printf "%s %s\\n" "$PREFIX" "$ARETERR" | frame >> "$LOGFILE" + PRINTED=1 + fi + unset ARETEXPL + unset ARETERR + unset PREFIX + else + ARETEXPL="ARETVAL not initialized. cron job was aborted prematurely." + ARETVAL=255 + FIGLETTEXT="abort" + printf "%s\\n" "$ARETEXPL" | frame >> "$MAILFILE" + printf "%s\\n" "$ARETEXPL" | frame >> "$LOGFILE" + PRINTED=1 + unset ARETEXPL + fi + if [ "${FIGLET:-yes}" = "yes" ] && [ -x "$(command -v figlet)" ] && [ -n "$FIGLETTEXT" ]; then + printf "\\n%s\\n\\n" "$(figlet $FIGLETTEXT)" >> "$MAILFILE" + PRINTED=1 + fi + if [ -n "$PRINTED" ]; then + printf "\\n" >> "$LOGFILE" + printf "\\n\\n" >> "$MAILFILE" + fi + unset PRINTED + + # script errors + + if [ -n "${ERRORLOG:-}" ] && [ -s "$ERRORLOG" ]; then + { + printf "script errors\\n" | frame + cat "$ERRORLOG" + printf "End of script errors\\n\\n" + } >> "$MAILFILE" + + { + printf "script errors\\n" | frame + cat "$ERRORLOG" + printf "End of script errors\\n" + } >> "$LOGFILE" + fi - if [ -n "${POSTRUNLOG:-}" ] && [ -s "$POSTRUNLOG" ]; then - printf "AIDE post run information\n" >> "$MAILFILE" - < "$POSTRUNLOG" cat >> "$MAILFILE" - printf "End of AIDE post run information\n\n" >> "$MAILFILE" + # aide post run information - printf "AIDE post run information\n" >> "$LOGFILE" - < "$POSTRUNLOG" cat >> "$LOGFILE" - printf "End of AIDE post run information\n" >> "$LOGFILE" - fi + if [ -n "${POSTRUNLOG:-}" ] && [ -s "$POSTRUNLOG" ]; then + { + printf "AIDE post run information\\n" + cat "$POSTRUNLOG" + printf "End of AIDE post run information\\n\\n" + } >> "$MAILFILE" - # include error log in daily report e-mail - - if [ -n "${AERRLOG:-}" ] && [ -s "$AERRLOG" ]; then - errorlines="$(wc -l "$AERRLOG" | awk '{ print $1 }')" - if [ "$LINES" -gt "0" ] && [ "${errorlines:=0}" -gt "$LINES" ]; then - printf "AIDE has returned many errors.\nthe error log output has been truncated in this mail\n" | \ - frame >> "$MAILFILE" - printf >> "$MAILFILE" "Error output is %d lines, truncated to %d.\n" "$errorlines" "$LINES" - < "$AERRLOG" head -n "$LINES" >> "$MAILFILE" - printf >> "$MAILFILE" "\nEnd of truncated AIDE error output. The full output can be found in %s.\n\n" "$LOGFILE" - else - printf >> "$MAILFILE" "Errors produced (%d lines):\n" "$errorlines" - < "$AERRLOG" cat >> "$MAILFILE" - printf >> "$MAILFILE" "\nEnd of AIDE error output.\n\n" - fi - printf >> "$LOGFILE" "AIDE error output (%d lines):\n" "$errorlines" - < "$AERRLOG" cat >> "$LOGFILE" - printf >> "$LOGFILE" "End of AIDE error output\n" - else - printf >> "$MAILFILE" "AIDE produced no errors.\n\n" - printf >> "$LOGFILE" "AIDE produced no errors.\n" - fi + { + printf "AIDE post run information\\n" + cat "$POSTRUNLOG" + printf "End of AIDE post run information\\n" + } >> "$LOGFILE" + fi + # include error log in daily report e-mail + + if [ -n "${AERRLOG:-}" ] && [ -s "$AERRLOG" ]; then + errorlines="$(wc -l "$AERRLOG" | awk '{ print $1 }')" + { + if [ "$LINES" -gt "0" ] && [ "${errorlines:=0}" -gt "$LINES" ]; then + printf "AIDE has returned many errors.\\nthe error log output has been truncated in this mail\\n" | \ + frame + printf "Error output is %d lines, truncated to %d.\\n" "$errorlines" "$LINES" + head -n "$LINES" "$AERRLOG" + printf "\\nEnd of truncated AIDE error output. The full output can be found in %s.\\n\\n" "$LOGFILE" + else + printf "Errors produced (%d lines):\\n" "$errorlines" + cat "$AERRLOG" + printf "\\nEnd of AIDE error output.\\n\\n" + fi + } >> "$MAILFILE" + { + printf "AIDE error output (%d lines):\\n" "$errorlines" + cat "$AERRLOG" + printf "End of AIDE error output\\n" + } >> "$LOGFILE" + else + printf >> "$MAILFILE" "AIDE produced no errors.\\n\\n" + printf >> "$LOGFILE" "AIDE produced no errors.\\n" + fi - # finish log file - if [ -n "${ARUNLOG:-}" ] && [ -s "$ARUNLOG" ]; then - printf >> "$LOGFILE" "AIDE output (%d lines):\n" "$(wc -l "$ARUNLOG" | awk '{ print $1 }')" - < "$ARUNLOG" cat >> "$LOGFILE" - printf >> "$LOGFILE" "End of AIDE output.\n\n" - else - printf >> "$LOGFILE" "AIDE detected no changes.\n\n" - fi + # finish log file + { + if [ -n "${ARUNLOG:-}" ] && [ -s "$ARUNLOG" ]; then + printf "AIDE output (%d lines):\\n" "$(wc -l "$ARUNLOG" | awk '{ print $1 }')" + cat "$ARUNLOG" + printf "End of AIDE output.\\n\\n" + else + printf "AIDE detected no changes.\\n\\n" + fi - if [ -n "${DBCHECKLOG:-}" ] && [ -s "$DBCHECKLOG" ]; then - < "$DBCHECKLOG" cat >> "$LOGFILE" - fi + if [ -n "${DBCHECKLOG:-}" ] && [ -s "$DBCHECKLOG" ]; then + cat "$DBCHECKLOG" + fi - ENDTIME="$(date +%s)" + ENDTIME="$(date +%s)" - printf >> "$LOGFILE" "End of AIDE daily cron job at %s, run time %d seconds\n" "$(date +"%Y-%m-%d %H:%M" -d@$ENDTIME)" "$(( $ENDTIME - $BEGINTIME ))" + printf "End of AIDE daily cron job at %s, run time %d seconds\\n" "$(date +"%Y-%m-%d %H:%M" -d@"$ENDTIME")" "$(( ENDTIME - BEGINTIME ))" + } >> "$LOGFILE" - LOGFILE_CHECKSUM="$(sha256sum $LOGFILE)" + LOGFILE_CHECKSUM="$(sha256sum "$LOGFILE")" - # include de-noised log into mail + # include de-noised log into mail - if [ -n "${ARUNLOG:-}" ] && [ -s "$ARUNLOG" ]; then + if [ -n "${ARUNLOG:-}" ] && [ -s "$ARUNLOG" ]; then - MAIL_MODE=0 + MAIL_MODE=0 - # truncate details - if [ "$TRUNCATEDETAILS" = "yes" ] ; then - case "$ARETVAL" in - 4|5|6|7) - MAILTMP="$(mytempfile aidemail)" - < $ARUNLOG sed '/^Detailed information about changes:$/,/^The attributes of the (uncompressed) database(s):$/{/^The attributes of the (uncompressed) database(s):$/!d}' >> "$MAILTMP" - MAIL_MODE=1 - ;; - *) - MAILTMP="$ARUNLOG" - ;; - esac + # truncate details + if [ "$TRUNCATEDETAILS" = "yes" ] ; then + case "$ARETVAL" in + 4|5|6|7) + MAILTMP="$(mytempfile aidemail)" + < "$ARUNLOG" sed '/^Detailed information about changes:$/,/^The attributes of the (uncompressed) database(s):$/{/^The attributes of the (uncompressed) database(s):$/!d}' >> "$MAILTMP" + MAIL_MODE=1 + ;; + *) + MAILTMP="$ARUNLOG" + ;; + esac - # Filter package upgrades/installations + # Filter package upgrades/installations - # Figure out where the dpkg log file is - DPKGLOG="$(< /etc/dpkg/dpkg.cfg grep "^log" | head -n 1 | cut -d ' ' -f 2)" + # Figure out where the dpkg log file is + DPKGLOG="$(< /etc/dpkg/dpkg.cfg grep "^log" | head -n 1 | cut -d ' ' -f 2)" - if ( [ "$FILTERUPDATES" = "yes" ] || [ "$FILTERINSTALLATIONS" = "yes" ] ) && [ -s "$DPKGLOG" ]; then + if { [ "$FILTERUPDATES" = "yes" ] || [ "$FILTERINSTALLATIONS" = "yes" ] ; } && [ -s "$DPKGLOG" ]; then - # Create a list of files modified by system updates - if ( [ "$FILTERUPDATES" = "yes" ] && [ "$FILTERINSTALLATIONS" = "yes" ] ) ; then FILTER="install|upgrade" - elif [ "$FILTERUPDATES" = "yes" ]; then FILTER="upgrade" - else FILTER="install" - fi - PKG_FILE_LIST="$(mytempfile pkg_file_list)" - REGEX="^([^ ]+ [^ ]+) ("$FILTER") ([^ ]+) [^ ]+ [^ ]+$" - pkgs= - while read line; do - if [[ $line =~ $REGEX ]] && [[ "$DATABASEDATE" < ${BASH_REMATCH[1]} ]]; then - if dpkg-query -L ${BASH_REMATCH[3]} > /dev/null 2>&1; then - pkgs+="${BASH_REMATCH[3]} (${BASH_REMATCH[2]})\n" - dpkg-query -L ${BASH_REMATCH[3]} | sed -e "/^$/d" -e "/\/\./d" >> "$PKG_FILE_LIST" - if ! ls /var/lib/dpkg/info/${BASH_REMATCH[3]}.* >> "$PKG_FILE_LIST" 2>/dev/null; then - ls /var/lib/dpkg/info/${BASH_REMATCH[3]%:*}.* >> "$PKG_FILE_LIST" - fi + # Create a list of files modified by system updates + if [ "$FILTERUPDATES" = "yes" ] && [ "$FILTERINSTALLATIONS" = "yes" ] ; then + FILTER="install|upgrade" + elif [ "$FILTERUPDATES" = "yes" ]; then + FILTER="upgrade" + else + FILTER="install" fi - fi - done < "$DPKGLOG" - - if [ -n "$pkgs" ]; then - FILTEREDMAIL=$(mytempfile filteredmail) - let MAIL_MODE=MAIL_MODE+2 - ADD=0; REM=0; CHG=0 - N_ADD=0; N_REM=0; N_CHG=0 - declare -a NF_ADD NF_REM NF_CHG - NF_ADD=() - NF_REM=() - NF_CHG=() - REGEX="^(changed|removed|added|[fdLDBFs?!][ :l<>=bpugamcinCAXSE.+-]{16}): (.*)" - BACKUPIFS="$IFS" - IFS="" - while read -r line; do - if [[ $line =~ $REGEX ]] ; then - [ -z "$(grep -xF "${BASH_REMATCH[2]}" "$PKG_FILE_LIST")" ] && DONTFILTER_FILE=true || DONTFILTER_FILE=false - case "${BASH_REMATCH[1]}" in - added|[fdLDBFs?]++++++++++++++++) - ((ADD++)) || true - if $DONTFILTER_FILE; then - ((N_ADD++)) || true - if $GROUPED; then - NF_ADD[${#NF_ADD[*]}]="$line" - else - NF_CHG[${#NF_CHG[*]}]="$line" - fi + PKG_FILE_LIST="$(mytempfile pkg_file_list)" + REGEX="^([^ ]+ [^ ]+) ($FILTER) ([^ ]+) [^ ]+ [^ ]+$" + PKGS=() + while read -r line; do + if [[ $line =~ $REGEX ]] && [[ "$DATABASEDATE" < ${BASH_REMATCH[1]} ]]; then + if dpkg-query -L "${BASH_REMATCH[3]}" > /dev/null 2>&1; then + PKGS+=("${BASH_REMATCH[3]} (${BASH_REMATCH[2]})") + dpkg-query -L "${BASH_REMATCH[3]}" | sed -e "/^$/d" -e "/\\/\\./d" >> "$PKG_FILE_LIST" + if ! ls "/var/lib/dpkg/info/${BASH_REMATCH[3]}."* >> "$PKG_FILE_LIST" 2>/dev/null; then + ls "/var/lib/dpkg/info/${BASH_REMATCH[3]%:*}."* >> "$PKG_FILE_LIST" fi - ;; - removed|[fdLDBFs?]----------------) - ((REM++)) || true - if $DONTFILTER_FILE; then - ((N_REM++)) || true - if $GROUPED; then - NF_REM[${#NF_REM[*]}]="$line" - else - NF_CHG[${#NF_CHG[*]}]="$line" + fi + fi + done < "$DPKGLOG" + + if [ ${#PKGS[@]} -gt 0 ]; then + FILTEREDMAIL=$(mytempfile filteredmail) + MAIL_MODE=$(( MAIL_MODE + 2 )) + ADD=0; REM=0; CHG=0 + N_ADD=0; N_REM=0; N_CHG=0 + declare -a NF_ADD NF_REM NF_CHG + NF_ADD=() + NF_REM=() + NF_CHG=() + REGEX="^(changed|removed|added|[fdLDBFs?!][ :l<>=bpugamcinCAXSE.+-]{16}): (.*)" + BACKUPIFS="$IFS" + IFS="" + while read -r line; do + if [[ $line =~ $REGEX ]] ; then + #shellcheck disable=SC2143 + [ -z "$(grep -xF "${BASH_REMATCH[2]}" "$PKG_FILE_LIST")" ] && DONTFILTER_FILE=true || DONTFILTER_FILE=false + case "${BASH_REMATCH[1]}" in + added|[fdLDBFs?]++++++++++++++++) + ((ADD++)) || true + if $DONTFILTER_FILE; then + ((N_ADD++)) || true + if $GROUPED; then + NF_ADD[${#NF_ADD[*]}]="$line" + else + NF_CHG[${#NF_CHG[*]}]="$line" + fi + fi + ;; + removed|[fdLDBFs?]----------------) + ((REM++)) || true + if $DONTFILTER_FILE; then + ((N_REM++)) || true + if $GROUPED; then + NF_REM[${#NF_REM[*]}]="$line" + else + NF_CHG[${#NF_CHG[*]}]="$line" + fi + fi + ;; + changed|[fdLDBFs?!]*) + ((CHG++)) || true + if $DONTFILTER_FILE; then + ((N_CHG++)) || true + NF_CHG[${#NF_CHG[*]}]="$line" + fi + ;; + *) + printf >> "$FILTEREDMAIL" "error: '%s' could not be matched, mail report is incomplete (full output can be found in %s)!! Please file a bug report against the aide-common package and include this error message.\\n" "${BASH_REMATCH[1]}" "$LOGFILE" + ;; + esac + fi + done < "$MAILTMP" + IFS=$BACKUPIFS + F_ADD=$(( ADD-N_ADD )) || true + F_REM=$(( REM-N_REM )) || true + F_CHG=$(( CHG-N_CHG )) || true + { + < "$MAILTMP" sed -n '0,/^ Total number of entries:/{p;}' + #shellcheck disable=SC2059 + { + SEPERATOR_TEMPLATE="\\n---------------------------------------------------\\n%s entries (filtered: %s):\\n---------------------------------------------------\\n\\n" + NUM_FILES_TEMPLATE=" %s entries:\\t\\t%s\\t(filtered: %s)\\n" + printf "$NUM_FILES_TEMPLATE" "Added" "$N_ADD" "$F_ADD" + printf "$NUM_FILES_TEMPLATE" "Removed" "$N_REM" "$F_REM" + printf "$NUM_FILES_TEMPLATE" "Changed" "$N_CHG" "$F_CHG" + printf "\\nThe following package changes were detected and were filtered from this mail:\\n" + printf '%s\n' "${PKGS[@]}" + if [ "$N_ADD" -eq "0" ] && [ "$N_REM" -eq "0" ] && [ "$N_CHG" -eq "0" ] ; then + printf "\\nAIDE detected no changes after filtering package changes.\\n\\n" + else + if [ "${#NF_ADD[@]}" -gt "0" ]; then + printf "$SEPERATOR_TEMPLATE" "Added" "$F_ADD" + for ((i=0;i<${#NF_ADD[@]};i++)); do printf "%s\\n" "${NF_ADD[$i]}"; done + fi + if [ "${#NF_REM[@]}" -gt "0" ]; then + printf "$SEPERATOR_TEMPLATE" "Removed" "$F_REM" + for ((i=0;i<${#NF_REM[@]};i++)); do printf "%s\\n" "${NF_REM[$i]}"; done + fi + if [ "${#NF_CHG[@]}" -gt "0" ]; then + if $GROUPED; then + printf "$SEPERATOR_TEMPLATE" "Changed" "$F_CHG" + else + if [ "$N_ADD" -gt "0" ] && [ "$N_REM" -gt "0" ] && [ "$N_CHG" -gt "0" ]; then + HEAD="Added, removed and changed" + elif [ "$N_ADD" -gt "0" ] && [ "$N_REM" -gt "0" ]; then + HEAD="Added and removed" + elif [ "$N_ADD" -gt "0" ] && [ "$N_CHG" -gt "0" ]; then + HEAD="Added and changed" + elif [ "$N_REM" -gt "0" ] && [ "$N_CHG" -gt "0" ]; then + HEAD="Removed and changed" + elif [ "$N_ADD" -gt "0" ]; then + HEAD="Added" + elif [ "$N_REM" -gt "0" ]; then + HEAD="Removed" + elif [ "$N_CHG" -gt "0" ]; then + HEAD="Changed" + fi + printf "$SEPERATOR_TEMPLATE" "$HEAD" "$((F_ADD+F_REM+F_CHG))" + fi + for ((i=0;i<${#NF_CHG[@]};i++)); do printf "%s\\n" "${NF_CHG[$i]}"; done fi fi - ;; - changed|[fdLDBFs?!]*) - ((CHG++)) || true - if $DONTFILTER_FILE; then - ((N_CHG++)) || true - NF_CHG[${#NF_CHG[*]}]="$line" - fi - ;; - *) - printf >> "$FILTEREDMAIL" "error: '%s' could not be matched, mail report is incomplete (full output can be found in %s)!! Please file a bug report against the aide-common package and include this error message.\n" "${BASH_REMATCH[1]}" "$LOGFILE" - ;; - esac + } + printf "\\n---------------------------------------------------\\n" + < "$MAILTMP" sed -n '/^The attributes of the (uncompressed) database(s):$/,$ {p;}' + } >> "$FILTEREDMAIL" + MAILTMP="$FILTEREDMAIL" fi - done < "$MAILTMP" - IFS=$BACKUPIFS - let F_ADD=$ADD-$N_ADD || true - let F_REM=$REM-$N_REM || true - let F_CHG=$CHG-$N_CHG || true - < $MAILTMP sed -n '0,/^ Total number of entries:/{p;}' >> "$FILTEREDMAIL" - SEPERATOR_TEMPLATE="\n---------------------------------------------------\n%s entries (filtered: %s):\n---------------------------------------------------\n\n" - NUM_FILES_TEMPLATE=" %s entries:\t\t%s\t(filtered: %s)\n" - printf >> "$FILTEREDMAIL" "$NUM_FILES_TEMPLATE" "Added" "$N_ADD" "$F_ADD" - printf >> "$FILTEREDMAIL" "$NUM_FILES_TEMPLATE" "Removed" "$N_REM" "$F_REM" - printf >> "$FILTEREDMAIL" "$NUM_FILES_TEMPLATE" "Changed" "$N_CHG" "$F_CHG" - printf >> "$FILTEREDMAIL" "\nThe following package changes were detected and were filtered from this mail:\n" - printf >> "$FILTEREDMAIL" "$pkgs" - if [ "$N_ADD" -eq "0" ] && [ "$N_REM" -eq "0" ] && [ "$N_CHG" -eq "0" ] ; then - printf >> "$FILTEREDMAIL" "\nAIDE detected no changes after filtering package changes.\n\n" - else - if [ "${#NF_ADD[@]}" -gt "0" ]; then - printf >> "$FILTEREDMAIL" "$SEPERATOR_TEMPLATE" "Added" "$F_ADD" - for ((i=0;i<${#NF_ADD[@]};i++)); do echo "${NF_ADD[$i]}" >> "$FILTEREDMAIL"; done + fi + else + MAILTMP="$ARUNLOG" + fi + + if [ -n "${NOISE:-}" ]; then + NOISETMP="$(mytempfile aidenoise1)" + NOISETMP2="$(mytempfile aidenoise2)" + < "$MAILTMP" sed -n '1,/^Detailed information about changes:/p' | \ + grep '^\(changed\|removed\|added\|[fdLDBFs?!][ :l<>=bpugamcinCAXSE.+-]\{16\}\):' | \ + grep -v "^added: THERE WERE ALSO [0-9]\\+ FILES ADDED UNDER THIS DIRECTORY" >> "$NOISETMP2" + + { + if [ -n "$NOISE" ]; then + ##+# leaning toothpick syndrome, consider grep -E + < "$NOISETMP2" grep -v "^\\(changed\\|removed\\|added\\|[fdLDBFs?!][ :l<>=bpugamcinCAXSE.+-]\\{16\\}\\): $NOISE" >> "$NOISETMP" || true + printf "De-Noised output removes everything matching %s.\\n" "$NOISE" fi - if [ "${#NF_REM[@]}" -gt "0" ]; then - printf >> "$FILTEREDMAIL" "$SEPERATOR_TEMPLATE" "Removed" "$F_REM" - for ((i=0;i<${#NF_REM[@]};i++)); do echo "${NF_REM[$i]}" >> "$FILTEREDMAIL"; done + + if [ -s "$NOISETMP" ]; then + loglines="$(< "$NOISETMP" wc -l | awk '{ print $1 }')" + if [ "$LINES" -gt "0" ] && [ "${loglines:=0}" -gt "$LINES" ]; then + printf "AIDE has returned long output which has been truncated in this mail\\n" | \ + frame + printf "De-Noised output is %d lines, truncated to %d.\\n" "$loglines" "$LINES" + head -n "$LINES" "$NOISETMP" + printf "\\nEnd of truncated De-Noised AIDE output. The full output can be found in %s.\\nsha256sum: %s\\n\\n" "$LOGFILE" "$LOGFILE_CHECKSUM" + else + printf "De-Noised output of the daily AIDE run (%d lines):\\n" "$loglines" + cat "$NOISETMP" + printf "\\nEnd of De-Noised AIDE output.\\n\\n" + fi + else + printf "AIDE detected no changes after removing noise.\\n\\n" fi - if [ "${#NF_CHG[@]}" -gt "0" ]; then - if $GROUPED; then - printf >> "$FILTEREDMAIL" "$SEPERATOR_TEMPLATE" "Changed" "$F_CHG" + printf "============================================================================\\n" + } + fi + + # include non-de-noised log into mail + + { + if [ -n "${MAILTMP:-}" ] && [ -s "$MAILTMP" ]; then + loglines="$(wc -l "$MAILTMP" | awk '{ print $1 }')" + if [ "$LINES" -gt "0" ] && [ "${loglines:=0}" -gt "$LINES" ]; then + printf "AIDE has returned long output which has been truncated in this mail\\n" | \ + frame + printf "Output is %d lines, truncated to %d.\\n" "$loglines" "$LINES" + head -n "$LINES" "$MAILTMP" + printf "\\nEnd of truncated AIDE output. The full output can be found in %s.\\nsha256sum: %s\\n\\n" "$LOGFILE" "$LOGFILE_CHECKSUM" + else + printf "Output of the daily AIDE run (%d lines):\\n" "$loglines" + cat "$MAILTMP" + if [ "$MAIL_MODE" -gt "0" ] ; then + case "$MAIL_MODE" in + 1) AIDE_OUTPUT="truncated" ;; + 2) AIDE_OUTPUT="filtered" ;; + 3) AIDE_OUTPUT="truncated and filtered" ;; + esac + printf "\\nEnd of %s AIDE output.\\n\\nThe full output can be found in %s.\\nsha256sum: %s\\n\\n" "$AIDE_OUTPUT" "$LOGFILE" "$LOGFILE_CHECKSUM" else - if [ "$N_ADD" -gt "0" ] && [ "$N_REM" -gt "0" ] && [ "$N_CHG" -gt "0" ]; then - HEAD="Added, removed and changed" - elif [ "$N_ADD" -gt "0" ] && [ "$N_REM" -gt "0" ]; then - HEAD="Added and removed" - elif [ "$N_ADD" -gt "0" ] && [ "$N_CHG" -gt "0" ]; then - HEAD="Added and changed" - elif [ "$N_REM" -gt "0" ] && [ "$N_CHG" -gt "0" ]; then - HEAD="Removed and changed" - elif [ "$N_ADD" -gt "0" ]; then - HEAD="Added" - elif [ "$N_REM" -gt "0" ]; then - HEAD="Removed" - elif [ "$N_CHG" -gt "0" ]; then - HEAD="Changed" - fi - printf >> "$FILTEREDMAIL" "$SEPERATOR_TEMPLATE" "$HEAD" "$((F_ADD+F_REM+F_CHG))" + printf "\\nEnd of AIDE output.\\n\\n" fi - for ((i=0;i<${#NF_CHG[@]};i++)); do echo "${NF_CHG[$i]}" >> "$FILTEREDMAIL"; done fi + else + printf "AIDE detected no changes.\\n\\n" fi - printf >> "$FILTEREDMAIL" "\n---------------------------------------------------\n" - < $MAILTMP sed -n '/^The attributes of the (uncompressed) database(s):$/,$ {p;}' >> "$FILTEREDMAIL" - MAILTMP="$FILTEREDMAIL" - fi + } >> "$MAILFILE" + else + printf >> "$MAILFILE" "funny, AIDE did not leave a log.\\n\\n" + printf >> "$LOGFILE" "funny, AIDE did not leave a log.\\n" fi - else - MAILTMP="$ARUNLOG" - fi - if [ -n "${NOISE:-}" ]; then - NOISETMP="$(mytempfile aidenoise1)" - NOISETMP2="$(mytempfile aidenoise2)" - < "$MAILTMP" sed -n '1,/^Detailed information about changes:/p' | \ - grep '^\(changed\|removed\|added\|[fdLDBFs?!][ :l<>=bpugamcinCAXSE.+-]\{16\}\):' | \ - grep -v "^added: THERE WERE ALSO [0-9]\+ FILES ADDED UNDER THIS DIRECTORY" >> "$NOISETMP2" - - if [ -n "$NOISE" ]; then - < "$NOISETMP2" grep -v "^\(changed\|removed\|added\|[fdLDBFs?!][ :l<>=bpugamcinCAXSE.+-]\{16\}\): $NOISE" >> "$NOISETMP" || true - printf >> "$MAILFILE" "De-Noised output removes everything matching %s.\n" "$NOISE" - fi - - if [ -s "$NOISETMP" ]; then - loglines="$(< $NOISETMP wc -l | awk '{ print $1 }')" - if [ "$LINES" -gt "0" ] && [ "${loglines:=0}" -gt "$LINES" ]; then - printf "AIDE has returned long output which has been truncated in this mail\n" | \ - frame >> "$MAILFILE" - printf >> "$MAILFILE" \ - "De-Noised output is %d lines, truncated to %d.\n" "$loglines" "$LINES" - < "$NOISETMP" head -n "$LINES" >> "$MAILFILE" - printf >> "$MAILFILE" "\nEnd of truncated De-Noised AIDE output. The full output can be found in %s.\nsha256sum: %s\n\n" "$LOGFILE" "$LOGFILE_CHECKSUM" - else - printf >> "$MAILFILE" "De-Noised output of the daily AIDE run (%d lines):\n" "$loglines" - < "$NOISETMP" cat >> "$MAILFILE" - printf >> "$MAILFILE" "\nEnd of De-Noised AIDE output.\n\n" - fi - else - printf >> "$MAILFILE" "AIDE detected no changes after removing noise.\n\n" - fi - printf >> "$MAILFILE" "============================================================================\n" - fi - - # include non-de-noised log into mail - - if [ -n "${MAILTMP:-}" ] && [ -s "$MAILTMP" ]; then - loglines="$(wc -l "$MAILTMP" | awk '{ print $1 }')" - if [ "$LINES" -gt "0" ] && [ "${loglines:=0}" -gt "$LINES" ]; then - printf "AIDE has returned long output which has been truncated in this mail\n" | \ - frame >> "$MAILFILE" - printf >> "$MAILFILE" \ - "Output is %d lines, truncated to %d.\n" "$loglines" "$LINES" - < "$MAILTMP" head -n "$LINES" >> "$MAILFILE" - printf >> "$MAILFILE" "\nEnd of truncated AIDE output. The full output can be found in %s.\nsha256sum: %s\n\n" "$LOGFILE" "$LOGFILE_CHECKSUM" - else - printf >> "$MAILFILE" "Output of the daily AIDE run (%d lines):\n" "$loglines" - < "$MAILTMP" cat >> "$MAILFILE" - if [ "$MAIL_MODE" -gt "0" ] ; then - case "$MAIL_MODE" in - 1) AIDE_OUTPUT="truncated" ;; - 2) AIDE_OUTPUT="filtered" ;; - 3) AIDE_OUTPUT="truncated and filtered" ;; - esac - printf >> "$MAILFILE" "\nEnd of %s AIDE output.\n\nThe full output can be found in %s.\nsha256sum: %s\n\n" "$AIDE_OUTPUT" "$LOGFILE" "$LOGFILE_CHECKSUM" - else - printf >> "$MAILFILE" "\nEnd of AIDE output.\n\n" + if [ -n "${DBCHECKLOG:-}" ] && [ -s "$DBCHECKLOG" ]; then + < "$DBCHECKLOG" cat >> "$MAILFILE" + printf >> "$MAILFILE" "\\n" fi - fi - else - printf >> "$MAILFILE" "AIDE detected no changes.\n\n" - fi - else - printf >> "$MAILFILE" "funny, AIDE did not leave a log.\n\n" - printf >> "$LOGFILE" "funny, AIDE did not leave a log.\n" - fi - if [ -n "${DBCHECKLOG:-}" ] && [ -s "$DBCHECKLOG" ]; then - < "$DBCHECKLOG" cat >> "$MAILFILE" - printf >> "$MAILFILE" "\n" - fi + printf >> "$MAILFILE" "End of AIDE daily cron job at %s, run time %d seconds\\n" "$(date +"%Y-%m-%d %H:%M" -d@"$ENDTIME")" "$(( ENDTIME - BEGINTIME ))" - printf >> "$MAILFILE" "End of AIDE daily cron job at %s, run time %d seconds\n" "$(date +"%Y-%m-%d %H:%M" -d@$ENDTIME)" "$(( $ENDTIME - $BEGINTIME ))" + # send mail if changes or errors were detected or quiet reports not requested + if [ "$QUIETREPORTS" != "yes" ] || [ "$ARETVAL" != "0" ] || [ "$(< "$ERRORLOG" wc -l)" -ne 0 ]; then + # do not send anything (not even error messages) if silence is requested + if [ "$SILENTREPORTS" != "yes" ]; then + < "$MAILFILE" mail -s "$MAILSUBJ" "$MAILTO" + fi + fi - # send mail if changes or errors were detected or quiet reports not requested - if [ "$QUIETREPORTS" != "yes" ] || [ "$ARETVAL" != "0" ] || [ $(< "$ERRORLOG" wc -l) -ne 0 ]; then - # do not send anything (not even error messages) if silence is requested - if [ "$SILENTREPORTS" != "yes" ]; then - < "$MAILFILE" mail -s "$MAILSUBJ" "$MAILTO" - fi + # clean up temp files + rm -rf "$TMPDIR" fi - # clean up temp files - rm -rf $TMPDIR - fi - - if [ -n "$CRONEXITHOOK" ] && [ -x "$CRONEXITHOOK" ]; then - $CRONEXITHOOK $CRONEXITHOOKPARM - fi + if [ -n "$CRONEXITHOOK" ] && [ -x "$CRONEXITHOOK" ]; then + $CRONEXITHOOK $CRONEXITHOOKPARM + fi - # clear lock - if [ -n "${LOCKED:-}" ] && command -v dotlockfile >/dev/null 2>&1; then - dotlockfile -u "$LOCKFILE" || true - fi - unset LOCKED + # clear lock + if [ -n "${LOCKED:-}" ] && command -v dotlockfile >/dev/null 2>&1; then + dotlockfile -u "$LOCKFILE" || true + fi + unset LOCKED - return 0 + return 0 } BEGINTIME="$(date +%s)" @@ -603,37 +680,36 @@ if [ "$CRON_DAILY_RUN" != "yes" ] && ! tty -s; then fi if command -v dotlockfile >/dev/null 2>&1; then - if ! dotlockfile -p -l "$LOCKFILE"; then - onexit nolock - exit 1 - fi + if ! dotlockfile -p -l "$LOCKFILE"; then + onexit nolock + exit 1 + fi else - PREERRLOG="no dotlockfile binary in path, not checking for already running aide cron job\n" + PREERRORLOG="no dotlockfile binary in path, not checking for already running aide cron job\\n" fi LOCKED=yes # prepare temp dir if [ -e "$TMPDIRIN" ]; then - if ! NEWNAME="$(mktemp -d $TMPBASE/cron.daily.old.XXXXXXXXXX)"; then - onexit cantmovetmp - exit 1 - fi - mv "$TMPDIRIN" "$NEWNAME" - unset NEWNAME - OLDTMPDIRFOUND="yes" + if ! NEWNAME="$(mktemp -d $TMPBASE/cron.daily.old.XXXXXXXXXX)"; then + onexit cantmovetmp + exit 1 + fi + mv "$TMPDIRIN" "$NEWNAME" + unset NEWNAME fi if ! mkdir -p $TMPDIRIN; then - onexit cantcreatetmp - exit 1 + onexit cantcreatetmp + exit 1 fi # handle the case that CRONEXITHOOK does not exist or is not executeable if [ -n "$CRONEXITHOOK" ]; then - if ! [ -x "$CRONEXITHOOK" ]; then - onexit nohook - exit 1 - fi + if ! [ -x "$CRONEXITHOOK" ]; then + onexit nohook + exit 1 + fi fi # we can now directly use file names inside $TMPDIR: It is only @@ -648,7 +724,7 @@ TMPDIR="$TMPDIRIN" ERRORLOG="$(mytempfile errorlog)" if [ -n "${PREERRORLOG:-}" ]; then - printf >> "$ERRORLOG" "$PREERRORLOG" + printf >> "$ERRORLOG" "%s" "$PREERRORLOG" fi unset PREERRORLOG @@ -659,10 +735,10 @@ MAILFILE="$(mytempfile mailfile)" ARETVAL=-1 if [ ! -f "$DATABASE" ]; then - printf >> "$ERRORLOG" "Fatal error: The AIDE database '%s' does not exist!\n" "$DATABASE" - printf >> "$ERRORLOG" "This may mean you haven't created it or that the initialization process is still running, or it may mean that someone has removed it.\n" - onexit fatal - exit 1 + printf >> "$ERRORLOG" "Fatal error: The AIDE database '%s' does not exist!\\n" "$DATABASE" + printf >> "$ERRORLOG" "This may mean you haven't created it or that the initialization process is still running, or it may mean that someone has removed it.\\n" + onexit fatal + exit 1 fi # code @@ -676,7 +752,7 @@ ARUNLOG="$(mytempfile arunlog)" # AERRLOG: standard error of aide run AERRLOG="$(mytempfile aerrlog)" -printf "begin timestamp %s\n" "$BEGINSTAMP" >> "$ARUNLOG" +printf "begin timestamp %s\\n" "$BEGINSTAMP" >> "$ARUNLOG" aide.wrapper $AIDEARGS "--$COMMAND" >|"$ARUNLOG" 2>|"$AERRLOG" && ARETVAL="$?" ARETVAL="$?" @@ -696,20 +772,21 @@ NOISETMP2="$(mytempfile noisetmp2)" COPYDB="0" if [ "$COPYNEWDB" = "ifnochange" ] && [ "$ARETVAL" = "0" ]; then - COPYDB="1" - printf >> "$POSTRUNLOG" "no significant changes detected.\n" + COPYDB="1" + printf >> "$POSTRUNLOG" "no significant changes detected.\\n" fi if [ "$COPYNEWDB" = "yes" ]; then - COPYDB=1 + COPYDB=1 fi if [ "$COPYDB" = "1" ] && [ "$COMMAND" = "update" ]; then - cp -f "$DATABASE_OUT" "$DATABASE" - printf >> "$POSTRUNLOG" "output database %s was copied to %s as requested by cron job configuration\n" "$DATABASE_OUT" "$DATABASE" + cp -f "$DATABASE_OUT" "$DATABASE" + printf >> "$POSTRUNLOG" "output database %s was copied to %s as requested by cron job configuration\\n" "$DATABASE_OUT" "$DATABASE" fi onexit success exit 0 +# vim: tabstop=4 expandtab # end of file diff --git a/cron.daily/dpkg b/cron.daily/dpkg index 0a6b05e1d..62da81727 100755 --- a/cron.daily/dpkg +++ b/cron.daily/dpkg @@ -9,16 +9,16 @@ if cd /var/backups ; then dbchanged=no dbfiles="arch status diversions statoverride" for db in $dbfiles ; do - if ! cmp -s dpkg.${db}.0 $dbdir/$db ; then + if ! cmp -s "dpkg.${db}.0" "$dbdir/$db"; then dbchanged=yes break; fi done if [ "$dbchanged" = "yes" ] ; then for db in $dbfiles ; do - [ -e $dbdir/$db ] || continue - cp -p $dbdir/$db dpkg.$db - savelog -c 7 dpkg.$db >/dev/null + [ -e "$dbdir/$db" ] || continue + cp -p "$dbdir/$db" "dpkg.$db" + savelog -c 7 "dpkg.$db" >/dev/null done fi diff --git a/cron.daily/logrotate b/cron.daily/logrotate index 0f1886459..1ac157001 100755 --- a/cron.daily/logrotate +++ b/cron.daily/logrotate @@ -1,14 +1,18 @@ #!/bin/sh -# Clean non existent log file entries from status file -cd /var/lib/logrotate -test -e status || touch status -head -1 status > status.clean -sed 's/"//g' status | while read logfile date -do - [ -e "$logfile" ] && echo "\"$logfile\" $date" -done >> status.clean -mv status.clean status +# skip in favour of systemd timer +if [ -d /run/systemd/system ]; then + exit 0 +fi + +# this cronjob persists removals (but not purges) +if [ ! -x /usr/sbin/logrotate ]; then + exit 0 +fi -test -x /usr/sbin/logrotate || exit 0 /usr/sbin/logrotate /etc/logrotate.conf +EXITVALUE=$? +if [ $EXITVALUE != 0 ]; then + /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]" +fi +exit $EXITVALUE diff --git a/cron.daily/man-db b/cron.daily/man-db index 0aeb8a51d..1342bc682 100755 --- a/cron.daily/man-db +++ b/cron.daily/man-db @@ -4,6 +4,11 @@ set -e +if [ -d /run/systemd/system ]; then + # Skip in favour of systemd timer. + exit 0 +fi + iosched_idle= # Don't try to change I/O priority in a vserver or OpenVZ. if ! egrep -q '(envID|VxID):.*[1-9]' /proc/self/status && \ @@ -17,7 +22,7 @@ if ! [ -d /var/cache/man ]; then fi # expunge old catman pages which have not been read in a week -if [ ! -d /run/systemd/system ] && [ -d /var/cache/man ]; then +if [ -d /var/cache/man ]; then cd / start-stop-daemon --start --pidfile /dev/null --startas /bin/sh \ --oknodo --chuid man $iosched_idle -- -c \ diff --git a/cron.daily/mlocate b/cron.daily/mlocate index 331d063a5..bc6954140 100755 --- a/cron.daily/mlocate +++ b/cron.daily/mlocate @@ -24,4 +24,4 @@ if [ -x /usr/bin/nocache ]; then NOCACHE="/usr/bin/nocache" fi -flock --nonblock /run/mlocate.daily.lock $NOCACHE $IONICE /usr/bin/updatedb.mlocate +flock --nonblock /run/mlocate.daily.lock $NOCACHE $IONICE nice /usr/bin/updatedb.mlocate diff --git a/cron.daily/passwd b/cron.daily/passwd deleted file mode 100755 index 4778bf090..000000000 --- a/cron.daily/passwd +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/sh - -cd /var/backups || exit 0 - -for FILE in passwd group shadow gshadow; do - test -f /etc/$FILE || continue - cmp -s $FILE.bak /etc/$FILE && continue - cp -p /etc/$FILE $FILE.bak && chmod 600 $FILE.bak -done diff --git a/cron.daily/popularity-contest b/cron.daily/popularity-contest index 0c14a9591..7078ddedd 100755 --- a/cron.daily/popularity-contest +++ b/cron.daily/popularity-contest @@ -14,8 +14,39 @@ unset MY_HOSTID unset PARTICIPATE unset SUBMITURLS unset USEHTTP +unset USETOR unset MTAOPS +TORIFY_PATH=/usr/bin/torify + +torify_enabled() { + # Return 1 to enable torify for HTTP submission, otherwise 0; exit on error + TORSOCKS_PATH=/usr/bin/torsocks + [ -f "$TORIFY_PATH" ] && [ -f "$TORSOCKS_PATH" ] && TOR_AVAILABLE=1 + + case "$USETOR" in + "yes") + if [ -z $TOR_AVAILABLE ]; then + echo "popularity-contest: USETOR is set but torify is not available." 2>&1 + echo "popularity-contest: Please install the tor and torsocks packages." 2>&1 + exit 1 + fi + if [ "yes" != "$USEHTTP" ]; then + echo "popularity-contest: when USETOR is set USEHTTP must be set as well" 2>&1 + exit 1 + fi + return 0 + ;; + "maybe") + [ "yes" = "$USEHTTP" ] && [ ! -z $TOR_AVAILABLE ] && return 0 + return 1 + ;; + "no") + return 1 + ;; + esac +} + # get configuration information . /usr/share/popularity-contest/default.conf . /etc/popularity-contest.conf @@ -33,6 +64,14 @@ if [ -z "$MAILTO" ] && [ "yes" != "$USEHTTP" ]; then exit 0; fi # don't run if PARTICIPATE is "no" or unset! if [ "$PARTICIPATE" = "no" ] || [ -z "$PARTICIPATE" ]; then exit 0; fi +# enable torify +if torify_enabled; then + TORIFY=$TORIFY_PATH +else + TORIFY='' +fi + + if [ -n "$HTTP_PROXY" ]; then export http_proxy="$HTTP_PROXY"; fi @@ -107,7 +146,7 @@ SUBMITTED=no # try to post the report through http POST if [ "$SUBMITURLS" ] && [ "yes" = "$USEHTTP" ]; then for URL in $SUBMITURLS ; do - if setsid /usr/share/popularity-contest/popcon-upload \ + if setsid $TORIFY /usr/share/popularity-contest/popcon-upload \ -u $URL -f $POPCON -C 2>/dev/null ; then SUBMITTED=yes else @@ -117,8 +156,9 @@ if [ "$SUBMITURLS" ] && [ "yes" = "$USEHTTP" ]; then fi # try to email the popularity contest data +# skip emailing if USETOR is set -if [ "$MODE" = "--crond" ] && [ yes != "$SUBMITTED" ] && [ "$MAILTO" ]; then +if [ "$MODE" = "--crond" ] && [ yes != "$SUBMITTED" ] && [ yes != "$USETOR" ] && [ "$MAILTO" ]; then if [ -x "`which sendmail 2>/dev/null`" ]; then ( if [ -n "$MAILFROM" ]; then diff --git a/cron.daily/spamassassin b/cron.daily/spamassassin index 333caf749..ed51ab6c3 100755 --- a/cron.daily/spamassassin +++ b/cron.daily/spamassassin @@ -29,11 +29,6 @@ die_with_lint() { } do_compile() { -# Compile rules if the required tools are available. Prior to version -# 3.3.2-8, there was an additional check to verify that an sa-compile -# run had previously been executed by hand. With sa-learn now -# distributed in a separate, optional, package, this check is no -# longer necessary. if [ -x /usr/bin/re2c -a -x /usr/bin/sa-compile ]; then env -i LANG="$LANG" PATH="$PATH" start-stop-daemon \ --chuid debian-spamd:debian-spamd --start \ @@ -42,7 +37,8 @@ do_compile() { # Fixup perms -- group and other should be able to # read and execute, but never write. Works around # sa-compile's failure to obey umask. - chmod -R go-w,go+rX /var/lib/spamassassin/compiled + runuser -u debian-spamd -- \ + chmod -R go-w,go+rX /var/lib/spamassassin/compiled fi } diff --git a/cron.daily/ubuntu-advantage-tools b/cron.daily/ubuntu-advantage-tools deleted file mode 100755 index 6d447463a..000000000 --- a/cron.daily/ubuntu-advantage-tools +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/sh -e - -UA="/usr/bin/ubuntu-advantage" -CACHE_DIR="/var/cache/ubuntu-advantage-tools" -CACHE_FILE="$CACHE_DIR/ubuntu-advantage-status.cache" - -[ -x "$UA" ] || exit 0 - -[ -d "$CACHE_DIR" ] || mkdir -p "$CACHE_DIR" - -"$UA" status > "$CACHE_FILE" - diff --git a/cron.weekly/man-db b/cron.weekly/man-db index 87da3b8e7..6e3ad83a2 100755 --- a/cron.weekly/man-db +++ b/cron.weekly/man-db @@ -4,6 +4,11 @@ set -e +if [ -d /run/systemd/system ]; then + # Skip in favour of systemd timer. + exit 0 +fi + iosched_idle= # Don't try to change I/O priority in a vserver or OpenVZ. if ! egrep -q '(envID|VxID):.*[1-9]' /proc/self/status && \ diff --git a/crontab b/crontab index 95edd9b1f..c89cc0be8 100644 --- a/crontab +++ b/crontab @@ -7,7 +7,14 @@ SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin -# m h dom mon dow user command +# Example of job definition: +# .---------------- minute (0 - 59) +# | .------------- hour (0 - 23) +# | | .---------- day of month (1 - 31) +# | | | .------- month (1 - 12) OR jan,feb,mar,apr ... +# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat +# | | | | | +# * * * * * user-name command to be executed 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) 47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) diff --git a/dbconfig-common/opendmarc.conf b/dbconfig-common/opendmarc.conf new file mode 100644 index 000000000..6a151aff4 --- /dev/null +++ b/dbconfig-common/opendmarc.conf @@ -0,0 +1,87 @@ +# automatically generated by the maintainer scripts of opendmarc +# any changes you make will be preserved, though your comments +# will be lost! to change your settings you should edit this +# file and then run "dpkg-reconfigure opendmarc" + +# dbc_install: configure database with dbconfig-common? +# set to anything but "true" to opt out of assistance +dbc_install='true' + +# dbc_upgrade: upgrade database with dbconfig-common? +# set to anything but "true" to opt out of assistance +dbc_upgrade='true' + +# dbc_remove: deconfigure database with dbconfig-common? +# set to anything but "true" to opt out of assistance +dbc_remove='true' + +# dbc_dbtype: type of underlying database to use +# this exists primarily to let dbconfig-common know what database +# type to use when a package supports multiple database types. +# don't change this value unless you know for certain that this +# package supports multiple database types +dbc_dbtype='mysql' + +# dbc_dbuser: database user +# the name of the user who we will use to connect to the database. +dbc_dbuser='opendmarc' + +# dbc_dbpass: database user password +# the password to use with the above username when connecting +# to a database, if one is required +dbc_dbpass='X8hmTLw3KIyX' + +# dbc_dballow: allowed host to connect from +# only for database types that support specifying the host from +# which the database user is allowed to connect from +# this string defines for which host the dbc_dbuser is allowed +# to connect +# this value is only really used again when you reconfigure the +# package +dbc_dballow='localhost' + +# dbc_dbserver: database host. +# leave unset to use localhost (or a more efficient local method +# if it exists). +dbc_dbserver='localhost' + +# dbc_dbport: remote database port +# leave unset to use the default. only applicable if you are +# using a remote database. +dbc_dbport='3306' + +# dbc_dbname: name of database +# this is the name of your application's database. +dbc_dbname='opendmarc' + +# dbc_dbadmin: name of the administrative user +# this is the administrative user that is used to create all of the above +# The exception is the MySQL/MariaDB localhost case, where this value is +# ignored and instead is determined from /etc/mysql/debian.cnf. +dbc_dbadmin='debian-sys-maint' + +# dbc_basepath: base directory to hold database files +# leave unset to use the default. only applicable if you are +# using a local (filesystem based) database. +dbc_basepath='' + +## +## postgresql specific settings. if you don't use postgresql, +## you can safely ignore all of these +## + +# dbc_ssl: should we require ssl? +# set to "true" to require that connections use ssl +dbc_ssl='' + +# dbc_authmethod_admin: authentication method for admin +# dbc_authmethod_user: authentication method for dbuser +# see the section titled "AUTHENTICATION METHODS" in +# /usr/share/doc/dbconfig-common/README.pgsql for more info +dbc_authmethod_admin='' +dbc_authmethod_user='' + +## +## end postgresql specific settings +## + diff --git a/debian_version b/debian_version index 2834e5822..37ad99eb8 100644 --- a/debian_version +++ b/debian_version @@ -1 +1 @@ -buster/sid +bullseye/sid diff --git a/default/amavisd-snmp-subagent b/default/amavisd-snmp-subagent index d94868b97..beee36766 100644 --- a/default/amavisd-snmp-subagent +++ b/default/amavisd-snmp-subagent @@ -1,7 +1,3 @@ -# To enable the amavis-snmp-subagent set ENABLED to yes - -ENABLED="no" - # there are two implementations of the subagent daemon: # 1) the default bdb version # 2) a zero mq based version diff --git a/default/dovecot b/default/dovecot index 84aacee8f..dee923997 100644 --- a/default/dovecot +++ b/default/dovecot @@ -1,7 +1,4 @@ # /etc/default/dovecot -# Set to '0' to explicitly disable starting Dovecot -#ENABLED=0 - # Set to '1' to allow Dovecot daemons to produce core dumps #ALLOW_COREDUMPS=1 diff --git a/default/grub.d/init-select.cfg b/default/grub.d/init-select.cfg new file mode 100644 index 000000000..7fbfff80b --- /dev/null +++ b/default/grub.d/init-select.cfg @@ -0,0 +1,7 @@ +# Work around a bug in the obsolete init-select package which broke +# grub-mkconfig when init-select was removed but not purged. This file does +# nothing and will be removed in a later release. +# +# See: +# https://bugs.debian.org/858528 +# https://bugs.debian.org/863801 diff --git a/default/named b/default/named new file mode 100644 index 000000000..66352f0a0 --- /dev/null +++ b/default/named @@ -0,0 +1,6 @@ +# +# run resolvconf? +RESOLVCONF=no + +# startup options for the server +OPTIONS="-u bind" diff --git a/default/opendkim b/default/opendkim index ffb2a021e..62b9fe9e9 100644 --- a/default/opendkim +++ b/default/opendkim @@ -1,10 +1,10 @@ # Command-line options specified here will override the contents of # /etc/opendkim.conf. See opendkim(8) for a complete list of options. #DAEMON_OPTS="" -# Change to /var/spool/postfix/var/run/opendkim to use a Unix socket with +# Change to /var/spool/postfix/run/opendkim to use a Unix socket with # postfix in a chroot: -#RUNDIR=/var/spool/postfix/var/run/opendkim -RUNDIR=/var/run/opendkim +#RUNDIR=/var/spool/postfix/run/opendkim +RUNDIR=/run/opendkim # # Uncomment to specify an alternate socket # Note that setting this will override any Socket value in opendkim.conf diff --git a/default/opendmarc b/default/opendmarc index ac891d81b..36a5f2cd9 100644 --- a/default/opendmarc +++ b/default/opendmarc @@ -7,7 +7,7 @@ RUNDIR=/var/run/opendmarc # # Uncomment to specify an alternate socket -# Note that setting this will override any Socket value in opendkim.conf +# Note that setting this will override any Socket value in opendmarc.conf # default: SOCKET=local:$RUNDIR/opendmarc.sock # listen on all interfaces on port 54321: diff --git a/default/rsyslog b/default/rsyslog deleted file mode 100644 index 8ec3ea0b1..000000000 --- a/default/rsyslog +++ /dev/null @@ -1,4 +0,0 @@ -# Options for rsyslogd -# -x disables DNS lookups for remote messages -# See rsyslogd(8) for more details -RSYSLOGD_OPTIONS="" diff --git a/default/spamassassin b/default/spamassassin index 1e957b770..9efb197e8 100644 --- a/default/spamassassin +++ b/default/spamassassin @@ -4,11 +4,10 @@ # WARNING: please read README.spamd before using. # There may be security risks. -# If you're using systemd (default for jessie), the ENABLED setting is -# not used. Instead, enable spamd by issuing: -# systemctl enable spamassassin.service -# Change to "1" to enable spamd on systems using sysvinit: -ENABLED=0 +# Prior to version 3.4.2-1, spamd could be enabled by setting +# ENABLED=1 in this file. This is no longer supported. Instead, please +# use the update-rc.d command, invoked for example as "update-rc.d +# spamassassin enable", to enable the spamd service. # Options # See man spamd for possible options. The -d option is automatically added. diff --git a/default/ufw b/default/ufw index 83c9ac3e6..7989f4bbb 100644 --- a/default/ufw +++ b/default/ufw @@ -34,13 +34,14 @@ MANAGE_BUILTINS=no # only enable if using iptables backend IPT_SYSCTL=/etc/ufw/sysctl.conf -# Extra connection tracking modules to load. Complete list can be found in -# net/netfilter/Kconfig of your kernel source. Some common modules: +# Extra connection tracking modules to load. IPT_MODULES should typically be +# empty for new installations and modules added only as needed. See +# 'CONNECTION HELPERS' from 'man ufw-framework' for details. Complete list can +# be found in net/netfilter/Kconfig of your kernel source. Some common modules: # nf_conntrack_irc, nf_nat_irc: DCC (Direct Client to Client) support # nf_conntrack_netbios_ns: NetBIOS (samba) client support # nf_conntrack_pptp, nf_nat_pptp: PPTP over stateful firewall/NAT # nf_conntrack_ftp, nf_nat_ftp: active FTP support # nf_conntrack_tftp, nf_nat_tftp: TFTP support (server side) # nf_conntrack_sane: sane support -IPT_MODULES="nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns" - +IPT_MODULES="" diff --git a/default/useradd b/default/useradd index a834feffc..e32955a72 100644 --- a/default/useradd +++ b/default/useradd @@ -2,7 +2,7 @@ # # The SHELL variable specifies the default login shell on your # system. -# Similar to DHSELL in adduser. However, we use "sh" here because +# Similar to DSHELL in adduser. However, we use "sh" here because # useradd is a low level utility and should be as general # as possible SHELL=/bin/sh diff --git a/e2scrub.conf b/e2scrub.conf new file mode 100644 index 000000000..661fc13fb --- /dev/null +++ b/e2scrub.conf @@ -0,0 +1,25 @@ +# e2scrub configuration file + +# Uncomment to enable automatic periodic runs of e2scrub_all +# (either via cron or via a systemd timer) +# periodic_e2scrub=1 + +# e-mail destination used by e2scrub_fail when problems are found with +# the file system. +# recipient=root + +# e-mail sender used by e2scrub_fail when problems are found with +# the file system. +# sender=e2scrub@host.domain.name + +# Snapshots will be created to run fsck; the snapshot will be of this size. +# snap_size_mb=256 + +# Set this to 1 to enable fstrim for everyone. +# fstrim=0 + +# Arguments passed into e2fsck. +# e2fsck_opts="-vtt" + +# Set this to 1 to have e2scrub_all scrub all LVs, not just the mounted ones. +# scrub_all=0 diff --git a/emacs/site-start.d/00debian-vars.el b/emacs/site-start.d/00debian-vars.el deleted file mode 100644 index a9db99cef..000000000 --- a/emacs/site-start.d/00debian-vars.el +++ /dev/null @@ -1,57 +0,0 @@ -;; 00debian-vars.el -;; -;; Initialize some emacs variables from debian policy files. -;; -;; Copyright (C) 1997, Frederic Lepied -;; -;; original Author: Frederic Lepied -;; enhanced and documented by: Mark Eichin - -;;============================================================================= -;; Autoloaded section. -;;============================================================================= - - -;;;### - -(eval-when-compile - ;; Quiet byte compiler - (defvar gnus-nntpserver-file)) - -;;;*** - - -;;============================================================================= -;; Configuration section. -;;============================================================================= -(defun debian-file->string (name &optional func) - "Convert a file into a string" - (interactive "fFile name : ") - (let ((filename (expand-file-name name))) - (if (not (file-readable-p filename)) - nil - (with-temp-buffer - ;; Do not run any user `find-file-hooks' - (insert-file-contents-literally filename) - (if func - (funcall func)) - (buffer-string))))) - -(defun debian-clean-mailname () - (while (search-forward "\n" nil t) - (replace-match "" nil t))) - -;; Particular variables, and their justification: -;; policy/ch4.html, 4.3 Mail processing on Debian systems, /etc/mailname -;; policy/ch-binarypkg.html, 3.5 Maintainer scripts, /etc/news/server - -(let ((mailname - (debian-file->string "/etc/mailname" (function debian-clean-mailname)))) - (if mailname - (setq mail-host-address mailname))) - -;; Don't need to check NNTPSERVER for override, gnus does that for us. -(if (file-readable-p "/etc/news/server") - (setq gnus-nntpserver-file "/etc/news/server")) - -;;; 00debian-vars.el ends here diff --git a/emacs/site-start.d/50dictionaries-common.el b/emacs/site-start.d/50dictionaries-common.el index 924f6053d..0719f652c 100644 --- a/emacs/site-start.d/50dictionaries-common.el +++ b/emacs/site-start.d/50dictionaries-common.el @@ -27,7 +27,10 @@ ;; a) It exists, that is, package is not removed. ;; b) Not in installations under dpkg control, otherwise we might get some ;; bogus errors on installation because of #132355 and friends. - (if (file-exists-p "/usr/share/emacs/site-lisp/dictionaries-common/debian-ispell.el") + (if (file-exists-p + (concat "/usr/share/" + (symbol-name debian-emacs-flavor) + "/site-lisp/dictionaries-common/debian-ispell.el")) (if (getenv "DPKG_RUNNING_VERSION") (message "Info: Skip debian-el loading if run under dpkg control.") (let ((coding-system-for-read 'raw-text)) ;; Read these as data streams diff --git a/emacs/site-start.el b/emacs/site-start.el deleted file mode 100644 index 06a95b157..000000000 --- a/emacs/site-start.el +++ /dev/null @@ -1,8 +0,0 @@ -;; Emacsen independent startup file. All of the various installed -;; flavors of emacs (emacs22, emacs23, xemacs21) will load this file -;; at startup. Make sure any code you put here is emacs flavor -;; independent. - -;; Package maintainers: do not have Debian packages edit this file. -;; See /usr/share/doc/emacsen-common/debian-emacs-policy.gz for the -;; proper way to handle Emacs package initialization code. diff --git a/etckeeper/commit.d/50vcs-commit b/etckeeper/commit.d/50vcs-commit index 55f0db244..bd4b1d4aa 100755 --- a/etckeeper/commit.d/50vcs-commit +++ b/etckeeper/commit.d/50vcs-commit @@ -12,16 +12,15 @@ if [ -n "$1" ]; then if [ "x$1" = "x--stdin" ]; then cat > "$logfile" else - if [ "x$1" = "x-m" ]; then - shift 1 - fi - echo "$1" > "$logfile" + sed '1s/^-m \{0,1\}//' >"$logfile" <<-EOF + $* + EOF fi else logfile="" fi -hostname=`hostname` +hostname=`hostname 2>/dev/null || cat /etc/hostname` hostname="${hostname%%.*}" dnsdomainname=`dnsdomainname 2>/dev/null || true` if [ -n "$dnsdomainname" ]; then @@ -41,9 +40,16 @@ else fi if [ "$VCS" = git ] && [ -d .git ]; then + # When not su'd to root, still set environment variables, + # since git's own code to determine the author and committer + # has several edge cases where it fails and would prevent the + # commit. + if [ -z "$USER" ]; then + USER="$(whoami)" + fi if [ -n "$USER" ]; then # Use user.name and user.email from the gitconfig belonging - # to the user who became root. + # to USER. USER_HOME="$(getent passwd "$USER" | cut -d: -f6)" if [ -n "$USER_HOME" ] && [ -e "$USER_HOME/.gitconfig" ]; then if [ -z "$GIT_AUTHOR_NAME" ]; then diff --git a/etckeeper/commit.d/99push b/etckeeper/commit.d/99push index b5418f743..3df1350b9 100755 --- a/etckeeper/commit.d/99push +++ b/etckeeper/commit.d/99push @@ -2,7 +2,7 @@ if [ -n "$PUSH_REMOTE" ]; then if [ "$VCS" = git ] && [ -d .git ]; then for REMOTE in $PUSH_REMOTE; do - git push "$REMOTE" master || true + git push "$REMOTE" || true done elif [ "$VCS" = hg ] && [ -d .hg ]; then for REMOTE in $PUSH_REMOTE; do diff --git a/etckeeper/init.d/40vcs-init b/etckeeper/init.d/40vcs-init index 3c7a3bb95..27eba4e96 100755 --- a/etckeeper/init.d/40vcs-init +++ b/etckeeper/init.d/40vcs-init @@ -1,17 +1,18 @@ #!/bin/sh set -e +description="$(hostname 2>/dev/null || cat /etc/hostname) /etc repository" if [ "$VCS" = git ] && [ ! -e .git ]; then git init - echo "$(hostname) /etc repository" > .git/description + echo "$description" > .git/description elif [ "$VCS" = hg ] && [ ! -e .hg ]; then hg init echo "[web]" > .hg/hgrc - echo "description = $(hostname) /etc repository" >> .hg/hgrc + echo "description = $description" >> .hg/hgrc elif [ "$VCS" = bzr ] && [ ! -e .bzr ]; then bzr init - bzr nick "$(hostname) /etc repository" + bzr nick "$description" elif [ "$VCS" = darcs ] && [ ! -e _darcs ]; then darcs initialize - echo "$(hostname) /etc repository" > _darcs/prefs/motd + echo "$description" > _darcs/prefs/motd fi diff --git a/etckeeper/list-installed.d/50list-installed b/etckeeper/list-installed.d/50list-installed index 129447f98..d89b8ceee 100755 --- a/etckeeper/list-installed.d/50list-installed +++ b/etckeeper/list-installed.d/50list-installed @@ -21,5 +21,7 @@ else pacmatic -Q elif [ "$LOWLEVEL_PACKAGE_MANAGER" = pkgng ]; then pkg info -E "*" + elif [ "$LOWLEVEL_PACKAGE_MANAGER" = apk ]; then + apk info -v | sort fi fi diff --git a/etckeeper/post-install.d/50vcs-commit b/etckeeper/post-install.d/50vcs-commit index 53138c82d..bc9cdf052 100755 --- a/etckeeper/post-install.d/50vcs-commit +++ b/etckeeper/post-install.d/50vcs-commit @@ -3,8 +3,23 @@ set -e pl="/var/cache/etckeeper/packagelist" +# Parent process is etckeeper +# (Only procps ps is currently supported, others will fail, +# so this may end up empty.) +ETCKEEPER_PID=$( ps --no-headers -o ppid "${PPID}" 2>/dev/null | sed 's/^ *//' ) + +# Find the parent of etckeeper and get the command line of the process +if ! [ -z "${ETCKEEPER_PID}" ]; then + ETCKEEPER_PPID=$( ps --no-headers -o ppid "${ETCKEEPER_PID}" | sed 's/^ *//' ) + ETCKEEPER_PARENT_COMMAND_LINE=$( ps --no-headers -o args "${ETCKEEPER_PPID}" ) +fi + if etckeeper unclean; then - message="committing changes in /etc after $HIGHLEVEL_PACKAGE_MANAGER run" + if [ -z "${ETCKEEPER_PARENT_COMMAND_LINE}" ]; then + message="committing changes in /etc after $HIGHLEVEL_PACKAGE_MANAGER run" + else + message="committing changes in /etc made by \"$ETCKEEPER_PARENT_COMMAND_LINE\"" + fi set +e if [ -e $pl.pre-install ] && [ "$(cat $pl.fmt 2>/dev/null || true)" = "$(etckeeper list-installed fmt)" ]; then @@ -24,5 +39,5 @@ if etckeeper unclean; then echo "warning: etckeeper failed to commit changes in /etc using $VCS" >&2 fi fi - + rm -f $pl.pre-install $pl.fmt diff --git a/etckeeper/pre-commit.d/20warn-problem-files b/etckeeper/pre-commit.d/20warn-problem-files index 4ffbfd187..6bd5c2bc4 100755 --- a/etckeeper/pre-commit.d/20warn-problem-files +++ b/etckeeper/pre-commit.d/20warn-problem-files @@ -2,7 +2,7 @@ set -e exclude_internal () { - egrep -v '(^|/)(.git|.hg|.bzr|_darcs)/' + egrep -v '(^|/)(\.git|\.hg|\.bzr|_darcs)/' } if [ "$VCS" = bzr ] || [ "$VCS" = darcs ]; then diff --git a/etckeeper/pre-commit.d/30store-metadata b/etckeeper/pre-commit.d/30store-metadata index 2b77c8eda..ce014d125 100755 --- a/etckeeper/pre-commit.d/30store-metadata +++ b/etckeeper/pre-commit.d/30store-metadata @@ -1,6 +1,10 @@ #!/bin/sh set -e +# Make sure sort always sorts in same order. +LANG=C +export LANG + filter_ignore() { case "$VCS" in darcs) ignorefile=.darcsignore ;; @@ -16,7 +20,11 @@ filter_ignore() { ;; git) (git ls-files -oi --exclude-standard; git ls-files -oi --exclude-standard --directory) | sort | uniq > "$listfile" || true - sed 's/^\.\///' | grep -xFvf "$listfile" + if [ -s "$listfile" ]; then + sed 's/^\.\///' | grep -xFvf "$listfile" + else + cat - + fi ;; esac rm -f "$listfile" @@ -51,6 +59,7 @@ generate_metadata() { # Keep the sort order the same at all times. LC_COLLATE=C export LC_COLLATE + unset LC_ALL if [ "$VCS" = git ] || [ "$VCS" = hg ]; then # These version control systems do not track directories, @@ -70,45 +79,71 @@ generate_metadata() { # Store things that don't have the default user or group. # Store all file modes, in case the user has an unusual umask. - find $NOVCS \( -type f -or -type d \) -print | filter_ignore | sort | perl -ne ' - BEGIN { $q=chr(39) } - sub uidname { - my $want=shift; - if (exists $uidcache{$want}) { - return $uidcache{$want}; - } - my $name=scalar getpwuid($want); - return $uidcache{$want}=defined $name ? $name : $want; - } - sub gidname { - my $want=shift; - if (exists $gidcache{$want}) { - return $gidcache{$want}; - } - my $name=scalar getgrgid($want); - return $gidcache{$want}=defined $name ? $name : $want; - } - chomp; - my @stat=stat($_); - my $mode = $stat[2]; - my $uid = $stat[4]; - my $gid = $stat[5]; - s/$q/$q"$q"$q/g; # escape single quotes - s/^/$q/; - s/$/$q/; - if ($uid != $>) { - printf "maybe chown $q%s$q %s\n", uidname($uid), $_; - } - if ($gid != $)) { - printf "maybe chgrp $q%s$q %s\n", gidname($gid), $_; - } - printf "maybe chmod %04o %s\n", $mode & 07777, $_; - ' + find $NOVCS \( -type f -or -type d \) -print | filter_ignore | sort | maybe_chmod_chown # We don't handle xattrs. # Maybe check for getfattr/setfattr and use them if they're available? } +maybe_chmod_chown() { + if [ "$(which perl 2>/dev/null)" != "" ]; then + perl -ne ' + BEGIN { $q=chr(39) } + sub uidname { + my $want=shift; + if (exists $uidcache{$want}) { + return $uidcache{$want}; + } + my $name=scalar getpwuid($want); + return $uidcache{$want}=defined $name ? $name : $want; + } + sub gidname { + my $want=shift; + if (exists $gidcache{$want}) { + return $gidcache{$want}; + } + my $name=scalar getgrgid($want); + return $gidcache{$want}=defined $name ? $name : $want; + } + chomp; + my @stat=stat($_); + my $mode = $stat[2]; + my $uid = $stat[4]; + my $gid = $stat[5]; + s/$q/$q"$q"$q/g; # escape single quotes + s/^/$q/; + s/$/$q/; + if ($uid != $>) { + printf "maybe chown $q%s$q %s\n", uidname($uid), $_; + } + if ($gid != $)) { + printf "maybe chgrp $q%s$q %s\n", gidname($gid), $_; + } + printf "maybe chmod %04o %s\n", $mode & 07777, $_; + ' + return $? + else + # fallback if perl isn't present + euid=$(id -u) + egid=$(id -g) + q="'" + while read x; do + stat=$(stat -c "%f:%u:%g:%a:%U:%G" $x) + IFS=":" read mode uid gid perm uname gname < ... # Comment +# +IPv4 0800 ip ip4 # IP (IPv4) +X25 0805 +ARP 0806 ether-arp # Address Resolution Protocol +FR_ARP 0808 # Frame Relay ARP [RFC1701] +BPQ 08FF # G8BPQ AX.25 over Ethernet +TRILL 22F3 # TRILL [RFC6325] +L2-IS-IS 22F4 # TRILL IS-IS [RFC6325] +TEB 6558 # Transparent Ethernet Bridging [RFC1701] +RAW_FR 6559 # Raw Frame Relay [RFC1701] +RARP 8035 # Reverse ARP [RFC903] +ATALK 809B # Appletalk +AARP 80F3 # Appletalk Address Resolution Protocol +802_1Q 8100 8021q 1q 802.1q dot1q # VLAN tagged frame [802.1q] +IPX 8137 # Novell IPX +NetBEUI 8191 # NetBEUI +IPv6 86DD ip6 # IP version 6 +PPP 880B # Point-to-Point Protocol +MPLS 8847 # MPLS [RFC5332] +MPLS_MULTI 8848 # MPLS with upstream-assigned label [RFC5332] +ATMMPOA 884C # MultiProtocol over ATM +PPP_DISC 8863 # PPP over Ethernet discovery stage +PPP_SES 8864 # PPP over Ethernet session stage +ATMFATE 8884 # Frame-based ATM Transport over Ethernet +EAPOL 888E # EAP over LAN [802.1x] +S-TAG 88A8 # QinQ Service VLAN tag identifier [802.1q] +EAP_PREAUTH 88C7 # EAPOL Pre-Authentication [802.11i] +LLDP 88CC # Link Layer Discovery Protocol [802.1ab] +MACSEC 88E5 # Media Access Control Security [802.1ae] +PBB 88E7 macinmac # Provider Backbone Bridging [802.1ah] +MVRP 88F5 # Multiple VLAN Registration Protocol [802.1q] +PTP 88F7 # Precision Time Protocol +FCOE 8906 # Fibre Channel over Ethernet +FIP 8914 # FCoE Initialization Protocol +ROCE 8915 # RDMA over Converged Ethernet diff --git a/fail2ban/action.d/abuseipdb.conf b/fail2ban/action.d/abuseipdb.conf index 15e41fbed..010af5b52 100644 --- a/fail2ban/action.d/abuseipdb.conf +++ b/fail2ban/action.d/abuseipdb.conf @@ -47,14 +47,17 @@ [Definition] +# bypass action for restored tickets +norestored = 1 + # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = @@ -80,13 +83,10 @@ actioncheck = # wherever you install the helper script. For the PHP helper script, see # # -# --ciphers ecdhe_ecdsa_aes_256_sha is used to workaround a -# "NSS error -12286" from curl as it attempts to connect using -# SSLv3. See https://www.centos.org/forums/viewtopic.php?t=52732 # Tags: See jail.conf(5) man page # Values: CMD # -actionban = curl --fail --ciphers ecdhe_ecdsa_aes_256_sha --data 'key=' --data-urlencode 'comment=' --data 'ip=' --data 'category=' "https://www.abuseipdb.com/report/json" +actionban = lgm=$(printf '%%.1000s\n...' ""); curl -sSf "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: " --data-urlencode "comment=$lgm" --data-urlencode "ip=" --data "categories=" # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -101,5 +101,5 @@ actionunban = # Notes Your API key from abuseipdb.com # Values: STRING Default: None # Register for abuseipdb [https://www.abuseipdb.com], get api key and set below. -# You will need to set the catagory in the action call. +# You will need to set the category in the action call. abuseipdb_apikey = diff --git a/fail2ban/action.d/badips.py b/fail2ban/action.d/badips.py index 473fbf335..805120e94 100644 --- a/fail2ban/action.d/badips.py +++ b/fail2ban/action.d/badips.py @@ -18,20 +18,22 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. import sys -if sys.version_info < (2, 7): +if sys.version_info < (2, 7): # pragma: no cover raise ImportError("badips.py action requires Python >= 2.7") import json import threading import logging -if sys.version_info >= (3, ): +if sys.version_info >= (3, ): # pragma: 2.x no cover from urllib.request import Request, urlopen from urllib.parse import urlencode from urllib.error import HTTPError -else: +else: # pragma: 3.x no cover from urllib2 import Request, urlopen, HTTPError from urllib import urlencode -from fail2ban.server.actions import ActionBase +from fail2ban.server.actions import Actions, ActionBase, BanTicket +from fail2ban.helpers import splitwords, str2LogLevel + class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable @@ -52,9 +54,6 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable age : str, optional Age of last report for bad IPs, per badips.com syntax. Default "24h" (24 hours) - key : str, optional - Key issued by badips.com to report bans, for later retrieval - of personalised content. banaction : str, optional Name of banaction to use for blacklisting bad IPs. If `None`, no blacklist of IPs will take place. @@ -65,11 +64,17 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable "postfix", but want to use whole "mail" category for blacklist. Default `category`. bankey : str, optional - Key issued by badips.com to blacklist IPs reported with the - associated key. + Key issued by badips.com to retrieve personal list + of blacklist IPs. updateperiod : int, optional Time in seconds between updating bad IPs blacklist. Default 900 (15 minutes) + loglevel : int/str, optional + Log level of the message when an IP is (un)banned. + Default `DEBUG`. + Can be also supplied as two-value list (comma- or space separated) to + provide level of the summary message when a group of IPs is (un)banned. + Example `DEBUG,INFO`. agent : str, optional User agent transmitted to server. Default `Fail2Ban/ver.` @@ -81,13 +86,13 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable """ TIMEOUT = 10 - _badips = "http://www.badips.com" + _badips = "https://www.badips.com" def _Request(self, url, **argv): return Request(url, headers={'User-Agent': self.agent}, **argv) - def __init__(self, jail, name, category, score=3, age="24h", key=None, - banaction=None, bancategory=None, bankey=None, updateperiod=900, agent="Fail2Ban", - timeout=TIMEOUT): + def __init__(self, jail, name, category, score=3, age="24h", + banaction=None, bancategory=None, bankey=None, updateperiod=900, + loglevel='DEBUG', agent="Fail2Ban", timeout=TIMEOUT): super(BadIPsAction, self).__init__(jail, name) self.timeout = timeout @@ -95,10 +100,12 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable self.category = category self.score = score self.age = age - self.key = key self.banaction = banaction self.bancategory = bancategory or category self.bankey = bankey + loglevel = splitwords(loglevel) + self.sumloglevel = str2LogLevel(loglevel[-1]) + self.loglevel = str2LogLevel(loglevel[0]) self.updateperiod = updateperiod self._bannedips = set() @@ -114,6 +121,15 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable except Exception as e: # pragma: no cover return False, e + def logError(self, response, what=''): # pragma: no cover - sporadical (502: Bad Gateway, etc) + messages = {} + try: + messages = json.loads(response.read().decode('utf-8')) + except: + pass + self._logSys.error( + "%s. badips.com response: '%s'", what, + messages.get('err', 'Unknown')) def getCategories(self, incParents=False): """Get badips.com categories. @@ -133,11 +149,8 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable try: response = urlopen( self._Request("/".join([self._badips, "get", "categories"])), timeout=self.timeout) - except HTTPError as response: - messages = json.loads(response.read().decode('utf-8')) - self._logSys.error( - "Failed to fetch categories. badips.com response: '%s'", - messages['err']) + except HTTPError as response: # pragma: no cover + self.logError(response, "Failed to fetch categories") raise else: response_json = json.loads(response.read().decode('utf-8')) @@ -186,12 +199,10 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable urlencode({'age': age})]) if key: url = "&".join([url, urlencode({'key': key})]) + self._logSys.debug('badips.com: get list, url: %r', url) response = urlopen(self._Request(url), timeout=self.timeout) - except HTTPError as response: - messages = json.loads(response.read().decode('utf-8')) - self._logSys.error( - "Failed to fetch bad IP list. badips.com response: '%s'", - messages['err']) + except HTTPError as response: # pragma: no cover + self.logError(response, "Failed to fetch bad IP list") raise else: return set(response.read().decode('utf-8').split()) @@ -219,7 +230,7 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable @bancategory.setter def bancategory(self, bancategory): - if bancategory not in self.getCategories(incParents=True): + if bancategory != "any" and bancategory not in self.getCategories(incParents=True): self._logSys.error("Category name '%s' not valid. " "see badips.com for list of valid categories", bancategory) @@ -271,13 +282,8 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable def _banIPs(self, ips): for ip in ips: try: - self._jail.actions[self.banaction].ban({ - 'ip': ip, - 'failures': 0, - 'matches': "", - 'ipmatches': "", - 'ipjailmatches': "", - }) + ai = Actions.ActionInfo(BanTicket(ip), self._jail) + self._jail.actions[self.banaction].ban(ai) except Exception as e: self._logSys.error( "Error banning IP %s for jail '%s' with action '%s': %s", @@ -285,27 +291,22 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG) else: self._bannedips.add(ip) - self._logSys.info( + self._logSys.log(self.loglevel, "Banned IP %s for jail '%s' with action '%s'", ip, self._jail.name, self.banaction) def _unbanIPs(self, ips): for ip in ips: try: - self._jail.actions[self.banaction].unban({ - 'ip': ip, - 'failures': 0, - 'matches': "", - 'ipmatches': "", - 'ipjailmatches': "", - }) + ai = Actions.ActionInfo(BanTicket(ip), self._jail) + self._jail.actions[self.banaction].unban(ai) except Exception as e: - self._logSys.info( + self._logSys.error( "Error unbanning IP %s for jail '%s' with action '%s': %s", ip, self._jail.name, self.banaction, e, exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG) else: - self._logSys.info( + self._logSys.log(self.loglevel, "Unbanned IP %s for jail '%s' with action '%s'", ip, self._jail.name, self.banaction) finally: @@ -333,12 +334,19 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable ips = self.getList( self.bancategory, self.score, self.age, self.bankey) # Remove old IPs no longer listed - self._unbanIPs(self._bannedips - ips) + s = self._bannedips - ips + m = len(s) + self._unbanIPs(s) # Add new IPs which are now listed - self._banIPs(ips - self._bannedips) - - self._logSys.info( - "Updated IPs for jail '%s'. Update again in %i seconds", + s = ips - self._bannedips + p = len(s) + self._banIPs(s) + if m != 0 or p != 0: + self._logSys.log(self.sumloglevel, + "Updated IPs for jail '%s' (-%d/+%d)", + self._jail.name, m, p) + self._logSys.debug( + "Next update for jail '%' in %i seconds", self._jail.name, self.updateperiod) finally: self._timer = threading.Timer(self.updateperiod, self.update) @@ -368,19 +376,15 @@ class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable Any issues with badips.com request. """ try: - url = "/".join([self._badips, "add", self.category, aInfo['ip']]) - if self.key: - url = "?".join([url, urlencode({'key': self.key})]) + url = "/".join([self._badips, "add", self.category, str(aInfo['ip'])]) + self._logSys.debug('badips.com: ban, url: %r', url) response = urlopen(self._Request(url), timeout=self.timeout) - except HTTPError as response: - messages = json.loads(response.read().decode('utf-8')) - self._logSys.error( - "Response from badips.com report: '%s'", - messages['err']) + except HTTPError as response: # pragma: no cover + self.logError(response, "Failed to ban") raise else: messages = json.loads(response.read().decode('utf-8')) - self._logSys.info( + self._logSys.debug( "Response from badips.com report: '%s'", messages['suc']) diff --git a/fail2ban/action.d/blocklist_de.conf b/fail2ban/action.d/blocklist_de.conf index 2f31d8b9b..ba6d427b4 100644 --- a/fail2ban/action.d/blocklist_de.conf +++ b/fail2ban/action.d/blocklist_de.conf @@ -31,13 +31,13 @@ [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = @@ -54,7 +54,7 @@ actioncheck = # Tags: See jail.conf(5) man page # Values: CMD # -actionban = curl --fail --data-urlencode 'server=' --data 'apikey=' --data 'service=' --data 'ip=' --data-urlencode 'logs=' --data 'format=text' --user-agent "" "https://www.blocklist.de/en/httpreports.html" +actionban = curl --fail --data-urlencode "server=" --data "apikey=" --data "service=" --data "ip=" --data-urlencode "logs=
" --data 'format=text' --user-agent "" "https://www.blocklist.de/en/httpreports.html" # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -64,10 +64,8 @@ actionban = curl --fail --data-urlencode 'server=' --data 'apikey=)' > /dev/null 2>&1 || ( ipfw show | awk 'BEGIN { b = } { if ($1 < b) {} else if ($1 == b) { b = $1 + 1 } else { e = b } } END { if (e) exit e
else exit b }'; num=$?; ipfw -q add $num from table\(\) to me ; echo $num > "" ) # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = [ ! -f ] || ( read num < ""
ipfw -q delete $num
rm "" ) @@ -38,7 +38,7 @@ actioncheck = # Values: CMD # # requires an ipfw rule like "deny ip from table(1) to me" -actionban = e=`ipfw table
add 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || { echo "$e" 1>&2; exit $x; } +actionban = e=`ipfw table
add 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || echo "$e" | grep -q "record already exists" || { echo "$e" 1>&2; exit $x; } # Option: actionunban @@ -47,7 +47,7 @@ actionban = e=`ipfw table
add 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ip # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = e=`ipfw table
delete 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || { echo "$e" 1>&2; exit $x; } +actionunban = e=`ipfw table
delete 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || echo "$e" | grep -q "record not found" || { echo "$e" 1>&2; exit $x; } [Init] # Option: table diff --git a/fail2ban/action.d/cloudflare.conf b/fail2ban/action.d/cloudflare.conf index 89df5b9e4..1c48a37ff 100644 --- a/fail2ban/action.d/cloudflare.conf +++ b/fail2ban/action.d/cloudflare.conf @@ -15,13 +15,13 @@ [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = diff --git a/fail2ban/action.d/complain.conf b/fail2ban/action.d/complain.conf index 1f74d6354..3a5f882c9 100644 --- a/fail2ban/action.d/complain.conf +++ b/fail2ban/action.d/complain.conf @@ -41,13 +41,13 @@ debug = 0 norestored = 1 # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = diff --git a/fail2ban/action.d/dshield.conf b/fail2ban/action.d/dshield.conf index 4f2e09cae..c128bef34 100644 --- a/fail2ban/action.d/dshield.conf +++ b/fail2ban/action.d/dshield.conf @@ -32,13 +32,13 @@ norestored = 1 # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = if [ -f .buffer ]; then diff --git a/fail2ban/action.d/dummy.conf b/fail2ban/action.d/dummy.conf index 41250c276..eb07e320f 100644 --- a/fail2ban/action.d/dummy.conf +++ b/fail2ban/action.d/dummy.conf @@ -7,7 +7,7 @@ [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = if [ ! -z '' ]; then touch ; fi; @@ -22,7 +22,7 @@ actionflush = printf %%b "-*\n" echo "%(debug)s clear all" # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = if [ ! -z '' ]; then rm -f ; fi; diff --git a/fail2ban/action.d/firewallcmd-ipset.conf b/fail2ban/action.d/firewallcmd-ipset.conf index dcf203756..a10652243 100644 --- a/fail2ban/action.d/firewallcmd-ipset.conf +++ b/fail2ban/action.d/firewallcmd-ipset.conf @@ -18,7 +18,7 @@ before = firewallcmd-common.conf [Definition] -actionstart = ipset create hash:ip timeout +actionstart = ipset create hash:ip timeout firewall-cmd --direct --add-rule filter 0 -m set --match-set src -j actionflush = ipset flush @@ -29,6 +29,8 @@ actionstop = firewall-cmd --direct --remove-rule filter 0 timeout -exist +actionprolong = %(actionban)s + actionunban = ipset del -exist [Init] @@ -40,11 +42,11 @@ actionunban = ipset del -exist # chain = INPUT_direct -# Option: bantime -# Notes: specifies the bantime in seconds (handled internally rather than by fail2ban) +# Option: default-timeout +# Notes: specifies default timeout in seconds (handled default ipset timeout only) # Values: [ NUM ] Default: 600 -bantime = 600 +default-timeout = 600 # Option: actiontype # Notes.: defines additions to the blocking rule diff --git a/fail2ban/action.d/helpers-common.conf b/fail2ban/action.d/helpers-common.conf index 5799d9d36..03422a877 100644 --- a/fail2ban/action.d/helpers-common.conf +++ b/fail2ban/action.d/helpers-common.conf @@ -1,16 +1,17 @@ -[DEFAULT] - -# Usage: -# _grep_logs_args = 'test' -# (printf %%b "Log-excerpt contains 'test':\n"; %(_grep_logs)s; printf %%b "Log-excerpt contains 'test':\n") | mail ... -# -_grep_logs = logpath=""; grep -E %(_grep_logs_args)s $logpath | -_grep_logs_args = "(^|[^0-9a-fA-F:])$(echo '' | sed 's/\./\\./g')([^0-9a-fA-F:]|$)" - -# Used for actions, that should not by executed if ticket was restored: -_bypass_if_restored = if [ '' = '1' ]; then exit 0; fi; - -[Init] -greplimit = tail -n -grepmax = 1000 -grepopts = -m +[DEFAULT] + +# Usage: +# _grep_logs_args = 'test' +# (printf %%b "Log-excerpt contains 'test':\n"; %(_grep_logs)s; printf %%b "Log-excerpt contains 'test':\n") | mail ... +# +_grep_logs = logpath=""; grep %(_grep_logs_args)s $logpath | +# options `-wF` used to match only whole words and fixed string (not as pattern) +_grep_logs_args = -wF "" + +# Used for actions, that should not by executed if ticket was restored: +_bypass_if_restored = if [ '' = '1' ]; then exit 0; fi; + +[Init] +greplimit = tail -n +grepmax = 1000 +grepopts = -m diff --git a/fail2ban/action.d/hostsdeny.conf b/fail2ban/action.d/hostsdeny.conf index 5cca6529b..8eebbaffe 100644 --- a/fail2ban/action.d/hostsdeny.conf +++ b/fail2ban/action.d/hostsdeny.conf @@ -8,13 +8,13 @@ [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = @@ -31,7 +31,7 @@ actioncheck = # Tags: See jail.conf(5) man page # Values: CMD # -actionban = IP= && printf %%b ": $IP\n" >> +actionban = printf %%b ": \n" >> # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -39,7 +39,7 @@ actionban = IP= && printf %%b ": $IP\n" >> # Tags: See jail.conf(5) man page # Values: CMD # -actionunban = IP=$(echo | sed 's/\./\\./g') && sed -i "/^: $IP$/d" +actionunban = IP=$(echo "" | sed 's/[][\.]/\\\0/g') && sed -i "/^: $IP$/d" [Init] @@ -54,3 +54,9 @@ file = /etc/hosts.deny # for hosts.deny/hosts_access. Default is all services. # Values: STR Default: ALL daemon_list = ALL + +# internal variable IP (to differentiate the IPv4 and IPv6 syntax, where it is enclosed in brackets): +ip_value = + +[Init?family=inet6] +ip_value = [] diff --git a/fail2ban/action.d/ipfilter.conf b/fail2ban/action.d/ipfilter.conf index 61420e38a..02091d60e 100644 --- a/fail2ban/action.d/ipfilter.conf +++ b/fail2ban/action.d/ipfilter.conf @@ -9,7 +9,7 @@ [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # # enable IPF if not already enabled @@ -17,7 +17,7 @@ actionstart = /sbin/ipf -E # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # # don't disable IPF with "/sbin/ipf -D", there may be other filters in use diff --git a/fail2ban/action.d/ipfw.conf b/fail2ban/action.d/ipfw.conf index 37625209f..956b154b0 100644 --- a/fail2ban/action.d/ipfw.conf +++ b/fail2ban/action.d/ipfw.conf @@ -8,14 +8,14 @@ [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = diff --git a/fail2ban/action.d/iptables-allports.conf b/fail2ban/action.d/iptables-allports.conf index dbea59840..caf9ab812 100644 --- a/fail2ban/action.d/iptables-allports.conf +++ b/fail2ban/action.d/iptables-allports.conf @@ -14,7 +14,7 @@ before = iptables-common.conf [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = -N f2b- @@ -22,7 +22,7 @@ actionstart = -N f2b- -I -p -j f2b- # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = -D -p -j f2b- diff --git a/fail2ban/action.d/iptables-ipset-proto4.conf b/fail2ban/action.d/iptables-ipset-proto4.conf index 30353f366..99ebbf8c1 100644 --- a/fail2ban/action.d/iptables-ipset-proto4.conf +++ b/fail2ban/action.d/iptables-ipset-proto4.conf @@ -24,7 +24,7 @@ before = iptables-common.conf [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = ipset --create f2b- iphash @@ -38,7 +38,7 @@ actionstart = ipset --create f2b- iphash actionflush = ipset --flush f2b- # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = -D -p -m multiport --dports -m set --match-set f2b- src -j diff --git a/fail2ban/action.d/iptables-ipset-proto6-allports.conf b/fail2ban/action.d/iptables-ipset-proto6-allports.conf index b761ad8c1..c851233cc 100644 --- a/fail2ban/action.d/iptables-ipset-proto6-allports.conf +++ b/fail2ban/action.d/iptables-ipset-proto6-allports.conf @@ -23,10 +23,10 @@ before = iptables-common.conf [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # -actionstart = ipset create hash:ip timeout +actionstart = ipset create hash:ip timeout -I -m set --match-set src -j # Option: actionflush @@ -36,7 +36,7 @@ actionstart = ipset create hash:ip timeout actionflush = ipset flush # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = -D -m set --match-set src -j @@ -51,6 +51,8 @@ actionstop = -D -m set --match-set src -j timeout -exist +actionprolong = %(actionban)s + # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the # command is executed with Fail2Ban user rights. @@ -61,11 +63,11 @@ actionunban = ipset del -exist [Init] -# Option: bantime -# Notes: specifies the bantime in seconds (handled internally rather than by fail2ban) +# Option: default-timeout +# Notes: specifies default timeout in seconds (handled default ipset timeout only) # Values: [ NUM ] Default: 600 -# -bantime = 600 + +default-timeout = 600 ipmset = f2b- familyopt = diff --git a/fail2ban/action.d/iptables-ipset-proto6.conf b/fail2ban/action.d/iptables-ipset-proto6.conf index e337eedf9..12c3ddd6f 100644 --- a/fail2ban/action.d/iptables-ipset-proto6.conf +++ b/fail2ban/action.d/iptables-ipset-proto6.conf @@ -23,10 +23,10 @@ before = iptables-common.conf [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # -actionstart = ipset create hash:ip timeout +actionstart = ipset create hash:ip timeout -I -p -m multiport --dports -m set --match-set src -j # Option: actionflush @@ -36,7 +36,7 @@ actionstart = ipset create hash:ip timeout actionflush = ipset flush # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = -D -p -m multiport --dports -m set --match-set src -j @@ -51,6 +51,8 @@ actionstop = -D -p -m multiport --dports -m # actionban = ipset add timeout -exist +actionprolong = %(actionban)s + # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the # command is executed with Fail2Ban user rights. @@ -61,11 +63,11 @@ actionunban = ipset del -exist [Init] -# Option: bantime -# Notes: specifies the bantime in seconds (handled internally rather than by fail2ban) +# Option: default-timeout +# Notes: specifies default timeout in seconds (handled default ipset timeout only) # Values: [ NUM ] Default: 600 -# -bantime = 600 + +default-timeout = 600 ipmset = f2b- familyopt = diff --git a/fail2ban/action.d/iptables-multiport-log.conf b/fail2ban/action.d/iptables-multiport-log.conf index 62c2b4b1d..df126dbf5 100644 --- a/fail2ban/action.d/iptables-multiport-log.conf +++ b/fail2ban/action.d/iptables-multiport-log.conf @@ -16,7 +16,7 @@ before = iptables-common.conf [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = -N f2b- @@ -34,7 +34,7 @@ actionflush = -F f2b- -F f2b--log # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = -D -p -m multiport --dports -j f2b- diff --git a/fail2ban/action.d/iptables-multiport.conf b/fail2ban/action.d/iptables-multiport.conf index c05f6ffc4..41b00c541 100644 --- a/fail2ban/action.d/iptables-multiport.conf +++ b/fail2ban/action.d/iptables-multiport.conf @@ -11,7 +11,7 @@ before = iptables-common.conf [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = -N f2b- @@ -19,7 +19,7 @@ actionstart = -N f2b- -I -p -m multiport --dports -j f2b- # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = -D -p -m multiport --dports -j f2b- diff --git a/fail2ban/action.d/iptables-new.conf b/fail2ban/action.d/iptables-new.conf index 5b316807d..39a17099e 100644 --- a/fail2ban/action.d/iptables-new.conf +++ b/fail2ban/action.d/iptables-new.conf @@ -13,7 +13,7 @@ before = iptables-common.conf [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = -N f2b- @@ -21,7 +21,7 @@ actionstart = -N f2b- -I -m state --state NEW -p --dport -j f2b- # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = -D -m state --state NEW -p --dport -j f2b- diff --git a/fail2ban/action.d/iptables-xt_recent-echo.conf b/fail2ban/action.d/iptables-xt_recent-echo.conf index 1970de14e..97449222c 100644 --- a/fail2ban/action.d/iptables-xt_recent-echo.conf +++ b/fail2ban/action.d/iptables-xt_recent-echo.conf @@ -12,7 +12,7 @@ before = iptables-common.conf [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # # Changing iptables rules requires root privileges. If fail2ban is @@ -42,7 +42,7 @@ actionstart = if [ `id -u` -eq 0 ];then -I -m recent --update actionflush = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = echo / > /proc/net/xt_recent/ diff --git a/fail2ban/action.d/iptables.conf b/fail2ban/action.d/iptables.conf index bf83e24a8..8ed5fdada 100644 --- a/fail2ban/action.d/iptables.conf +++ b/fail2ban/action.d/iptables.conf @@ -11,7 +11,7 @@ before = iptables-common.conf [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = -N f2b- @@ -19,7 +19,7 @@ actionstart = -N f2b- -I -p --dport -j f2b- # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = -D -p --dport -j f2b- diff --git a/fail2ban/action.d/mail-buffered.conf b/fail2ban/action.d/mail-buffered.conf index 88cd623fb..325f185b2 100644 --- a/fail2ban/action.d/mail-buffered.conf +++ b/fail2ban/action.d/mail-buffered.conf @@ -10,7 +10,7 @@ norestored = 1 # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = printf %%b "Hi,\n @@ -20,7 +20,7 @@ actionstart = printf %%b "Hi,\n Fail2Ban"|mail -s "[Fail2Ban] : started on " # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = if [ -f ]; then diff --git a/fail2ban/action.d/mail-whois-common.conf b/fail2ban/action.d/mail-whois-common.conf index b0d27afc3..ecf3a5d91 100644 --- a/fail2ban/action.d/mail-whois-common.conf +++ b/fail2ban/action.d/mail-whois-common.conf @@ -17,7 +17,7 @@ _whois = whois || echo "missing whois program" # character set before sending it to a mail program # make sure you have 'file' and 'iconv' commands installed when opting for that _whois_target_charset = UTF-8 -_whois_convert_charset = whois | +_whois_convert_charset = (%(_whois)s) | { WHOIS_OUTPUT=$(cat) ; WHOIS_CHARSET=$(printf %%b "$WHOIS_OUTPUT" | file -b --mime-encoding -) ; printf %%b "$WHOIS_OUTPUT" | iconv -f $WHOIS_CHARSET -t %(_whois_target_charset)s//TRANSLIT - ; } # choose between _whois and _whois_convert_charset in mail-whois-common.local diff --git a/fail2ban/action.d/mail-whois-lines.conf b/fail2ban/action.d/mail-whois-lines.conf index 37e2d9b01..3a3e56b2c 100644 --- a/fail2ban/action.d/mail-whois-lines.conf +++ b/fail2ban/action.d/mail-whois-lines.conf @@ -15,7 +15,7 @@ before = mail-whois-common.conf norestored = 1 # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = printf %%b "Hi,\n @@ -24,7 +24,7 @@ actionstart = printf %%b "Hi,\n Fail2Ban" | "[Fail2Ban] : started on " # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = printf %%b "Hi,\n diff --git a/fail2ban/action.d/mail-whois.conf b/fail2ban/action.d/mail-whois.conf index 1f69f4c6b..7fea34c40 100644 --- a/fail2ban/action.d/mail-whois.conf +++ b/fail2ban/action.d/mail-whois.conf @@ -14,7 +14,7 @@ before = mail-whois-common.conf norestored = 1 # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = printf %%b "Hi,\n @@ -23,7 +23,7 @@ actionstart = printf %%b "Hi,\n Fail2Ban"|mail -s "[Fail2Ban] : started on " # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = printf %%b "Hi,\n diff --git a/fail2ban/action.d/mail.conf b/fail2ban/action.d/mail.conf index cfc1cf65e..5d8c0e154 100644 --- a/fail2ban/action.d/mail.conf +++ b/fail2ban/action.d/mail.conf @@ -10,7 +10,7 @@ norestored = 1 # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = printf %%b "Hi,\n @@ -19,7 +19,7 @@ actionstart = printf %%b "Hi,\n Fail2Ban"|mail -s "[Fail2Ban] : started on " # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = printf %%b "Hi,\n diff --git a/fail2ban/action.d/mynetwatchman.conf b/fail2ban/action.d/mynetwatchman.conf index 8f3edf9e6..b0ab2cc38 100644 --- a/fail2ban/action.d/mynetwatchman.conf +++ b/fail2ban/action.d/mynetwatchman.conf @@ -28,13 +28,13 @@ [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = diff --git a/fail2ban/action.d/nftables-allports.conf b/fail2ban/action.d/nftables-allports.conf index 6c69da39f..908abe400 100644 --- a/fail2ban/action.d/nftables-allports.conf +++ b/fail2ban/action.d/nftables-allports.conf @@ -6,17 +6,12 @@ # Modified: Alexander Belykh # adapted for nftables # +# Obsolete: superseded by nftables[type=allports] [INCLUDES] -before = nftables-common.conf +before = nftables.conf [Definition] -# Option: nftables_mode -# Notes.: additional expressions for nftables filter rule -# Values: nftables expressions -# -nftables_mode = meta l4proto - -[Init] +type = allports diff --git a/fail2ban/action.d/nftables-multiport.conf b/fail2ban/action.d/nftables-multiport.conf index d1afafb32..ba3ec92c9 100644 --- a/fail2ban/action.d/nftables-multiport.conf +++ b/fail2ban/action.d/nftables-multiport.conf @@ -6,17 +6,12 @@ # Modified: Alexander Belykh # adapted for nftables # +# Obsolete: superseded by nftables[type=multiport] [INCLUDES] -before = nftables-common.conf +before = nftables.conf [Definition] -# Option: nftables_mode -# Notes.: additional expressions for nftables filter rule -# Values: nftables expressions -# -nftables_mode = dport \{ \} - -[Init] +type = multiport \ No newline at end of file diff --git a/fail2ban/action.d/nftables.conf b/fail2ban/action.d/nftables.conf new file mode 100644 index 000000000..c1fb8550f --- /dev/null +++ b/fail2ban/action.d/nftables.conf @@ -0,0 +1,203 @@ +# Fail2Ban configuration file +# +# Author: Daniel Black +# Author: Cyril Jaquier +# Modified: Yaroslav O. Halchenko +# made active on all ports from original iptables.conf +# Modified: Alexander Belykh +# adapted for nftables +# +# This is a included configuration file and includes the definitions for the nftables +# used in all nftables based actions by default. +# +# The user can override the defaults in nftables-common.local +# Example: redirect flow to honeypot +# +# [Init] +# table_family = ip +# chain_type = nat +# chain_hook = prerouting +# chain_priority = -50 +# blocktype = counter redirect to 2222 + +[INCLUDES] + +after = nftables-common.local + +[Definition] + +# Option: type +# Notes.: type of the action. +# Values: [ multiport | allports ] Default: multiport +# +type = multiport + +rule_match-custom = +rule_match-allports = meta l4proto \{ \} +rule_match-multiport = $proto dport \{ \} +match = > + +# Option: rule_stat +# Notes.: statement for nftables filter rule. +# leaving it empty will block all (include udp and icmp) +# Values: nftables statement +# +rule_stat = %(match)s saddr @ + +# optional interator over protocol's: +_nft_for_proto-custom-iter = +_nft_for_proto-custom-done = +_nft_for_proto-allports-iter = +_nft_for_proto-allports-done = +_nft_for_proto-multiport-iter = for proto in $(echo '' | sed 's/,/ /g'); do +_nft_for_proto-multiport-done = done + +_nft_list = -a list chain
+_nft_get_handle_id = grep -oP '@\s+.*\s+\Khandle\s+(\d+)$' + +_nft_add_set = add set
\{ type \; \} + <_nft_for_proto--iter> + add rule
%(rule_stat)s + <_nft_for_proto--done> +_nft_del_set = { %(_nft_list)s | %(_nft_get_handle_id)s; } | while read -r hdl; do + delete rule
$hdl; done + delete set
+ +# Option: _nft_shutdown_table +# Notes.: command executed after the stop in order to delete table (it checks that no sets are available): +# Values: CMD +# +_nft_shutdown_table = { list table
| grep -qP '^\s+set\s+'; } || { + delete table
+ } + +# Option: actionstart +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). +# Values: CMD +# +actionstart = add table
+ -- add chain
\{ type hook priority \; \} + %(_nft_add_set)s + +# Option: actionflush +# Notes.: command executed once to flush IPS, by shutdown (resp. by stop of the jail or this action); +# uses `nft flush set ...` and as fallback (e. g. unsupported) recreates the set (with references) +# Values: CMD +# +actionflush = { flush set
2> /dev/null; } || { + %(_nft_del_set)s + %(_nft_add_set)s + } + +# Option: actionstop +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +# Values: CMD +# +actionstop = %(_nft_del_set)s + <_nft_shutdown_table> + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = list chain
| grep -q '@[ \t]' + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = add element
\{ \} + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = delete element
\{ \} + +[Init] + +# Option: table +# Notes.: main table to store chain and sets (automatically created on demand) +# Values: STRING Default: f2b-table +table = f2b-table + +# Option: table_family +# Notes.: address family to work in +# Values: [ip | ip6 | inet] Default: inet +table_family = inet + +# Option: chain +# Notes.: main chain to store rules +# Values: STRING Default: f2b-chain +chain = f2b-chain + +# Option: chain_type +# Notes.: refers to the kind of chain to be created +# Values: [filter | route | nat] Default: filter +# +chain_type = filter + +# Option: chain_hook +# Notes.: refers to the kind of chain to be created +# Values: [ prerouting | input | forward | output | postrouting ] Default: input +# +chain_hook = input + +# Option: chain_priority +# Notes.: priority in the chain. +# Values: NUMBER Default: -1 +# +chain_priority = -1 + +# Option: addr_type +# Notes.: address type to work with +# Values: [ipv4_addr | ipv6_addr] Default: ipv4_addr +# +addr_type = ipv4_addr + +# Default name of the filtering set +# +name = default + +# Option: port +# Notes.: specifies port to monitor +# Values: [ NUM | STRING ] Default: +# +port = ssh + +# Option: protocol +# Notes.: internally used by config reader for interpolations. +# Values: [ tcp | udp ] Default: tcp +# +protocol = tcp + +# Option: blocktype +# Note: This is what the action does with rules. This can be any jump target +# as per the nftables man page (section 8). Common values are drop, +# reject, reject with icmpx type host-unreachable, redirect to 2222 +# Values: STRING +blocktype = reject + +# Option: nftables +# Notes.: Actual command to be executed, including common to all calls options +# Values: STRING +nftables = nft + +# Option: addr_set +# Notes.: The name of the nft set used to store banned addresses +# Values: STRING +addr_set = addr-set- + +# Option: addr_family +# Notes.: The family of the banned addresses +# Values: [ ip | ip6 ] +addr_family = ip + +[Init?family=inet6] +addr_family = ip6 +addr_type = ipv6_addr +addr_set = addr6-set- diff --git a/fail2ban/action.d/nginx-block-map.conf b/fail2ban/action.d/nginx-block-map.conf index 33c15f9c9..0b6aa0ad7 100644 --- a/fail2ban/action.d/nginx-block-map.conf +++ b/fail2ban/action.d/nginx-block-map.conf @@ -105,4 +105,4 @@ actioncheck = actionban = echo "\\\\ 1;" >> '%(blck_lst_file)s'; %(blck_lst_reload)s -actionunban = id=$(echo "" | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/$id 1;/d" %(blck_lst_file)s; %(blck_lst_reload)s +actionunban = id=$(echo "" | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/^\\\\$id 1;$/d" %(blck_lst_file)s; %(blck_lst_reload)s diff --git a/fail2ban/action.d/npf.conf b/fail2ban/action.d/npf.conf index 8b00d1773..3bbb2f514 100644 --- a/fail2ban/action.d/npf.conf +++ b/fail2ban/action.d/npf.conf @@ -9,7 +9,7 @@ [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # # we don't enable NPF automatically, as it will be enabled elsewhere @@ -17,7 +17,7 @@ actionstart = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # # we don't disable NPF automatically either diff --git a/fail2ban/action.d/nsupdate.conf b/fail2ban/action.d/nsupdate.conf index 7886825c7..ef56c6bd5 100644 --- a/fail2ban/action.d/nsupdate.conf +++ b/fail2ban/action.d/nsupdate.conf @@ -42,14 +42,14 @@ [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = diff --git a/fail2ban/action.d/osx-afctl.conf b/fail2ban/action.d/osx-afctl.conf index a319fc6bc..a75e5723d 100644 --- a/fail2ban/action.d/osx-afctl.conf +++ b/fail2ban/action.d/osx-afctl.conf @@ -12,5 +12,5 @@ actioncheck = actionban = /usr/libexec/afctl -a -t actionunban = /usr/libexec/afctl -r -[Init] -bantime = 2880 +actionprolong = %(actionunban)s && %(actionban)s + diff --git a/fail2ban/action.d/osx-ipfw.conf b/fail2ban/action.d/osx-ipfw.conf index abe4009c7..6ff6afdff 100644 --- a/fail2ban/action.d/osx-ipfw.conf +++ b/fail2ban/action.d/osx-ipfw.conf @@ -9,14 +9,14 @@ [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = diff --git a/fail2ban/action.d/pf.conf b/fail2ban/action.d/pf.conf index 905312c35..933b4de01 100644 --- a/fail2ban/action.d/pf.conf +++ b/fail2ban/action.d/pf.conf @@ -10,7 +10,7 @@ [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # # we don't enable PF automatically; to enable run pfctl -e @@ -35,7 +35,7 @@ actionstart = echo "table <-> persist counters" | -f- actionstart_on_demand = false # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # # we only disable PF rules we've installed prior diff --git a/fail2ban/action.d/sendmail-buffered.conf b/fail2ban/action.d/sendmail-buffered.conf index 37bc642df..13803f8b7 100644 --- a/fail2ban/action.d/sendmail-buffered.conf +++ b/fail2ban/action.d/sendmail-buffered.conf @@ -14,7 +14,7 @@ before = sendmail-common.conf norestored = 1 # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = printf %%b "Subject: [Fail2Ban] : started on @@ -24,10 +24,10 @@ actionstart = printf %%b "Subject: [Fail2Ban] : started on The jail has been started successfully.\n Output will be buffered until lines are available.\n Regards,\n - Fail2Ban" | /usr/sbin/sendmail -f + Fail2Ban" | # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = if [ -f ]; then @@ -38,7 +38,7 @@ actionstop = if [ -f ]; then These hosts have been banned by Fail2Ban.\n `cat ` Regards,\n - Fail2Ban" | /usr/sbin/sendmail -f + Fail2Ban" | rm fi printf %%b "Subject: [Fail2Ban] : stopped on @@ -47,7 +47,7 @@ actionstop = if [ -f ]; then Hi,\n The jail has been stopped.\n Regards,\n - Fail2Ban" | /usr/sbin/sendmail -f + Fail2Ban" | # Option: actioncheck # Notes.: command executed once before each actionban command @@ -71,7 +71,7 @@ actionban = printf %%b "`date`: ( failures)\n" >> These hosts have been banned by Fail2Ban.\n `cat ` Regards,\n - Fail2Ban" | /usr/sbin/sendmail -f + Fail2Ban" | rm fi diff --git a/fail2ban/action.d/sendmail-common.conf b/fail2ban/action.d/sendmail-common.conf index 46eca9ca4..1e31fadfa 100644 --- a/fail2ban/action.d/sendmail-common.conf +++ b/fail2ban/action.d/sendmail-common.conf @@ -11,7 +11,7 @@ after = sendmail-common.local [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = printf %%b "Subject: [Fail2Ban] : started on @@ -21,10 +21,10 @@ actionstart = printf %%b "Subject: [Fail2Ban] : started on Hi,\n The jail has been started successfully.\n Regards,\n - Fail2Ban" | /usr/sbin/sendmail -f + Fail2Ban" | # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = printf %%b "Subject: [Fail2Ban] : stopped on @@ -34,7 +34,7 @@ actionstop = printf %%b "Subject: [Fail2Ban] : stopped on Hi,\n The jail has been stopped.\n Regards,\n - Fail2Ban" | /usr/sbin/sendmail -f + Fail2Ban" | # Option: actioncheck # Notes.: command executed once before each actionban command @@ -60,6 +60,10 @@ actionunban = [Init] +# Your system mail command +# +mailcmd = /usr/sbin/sendmail -f "" "" + # Recipient mail address # dest = root diff --git a/fail2ban/action.d/sendmail-geoip-lines.conf b/fail2ban/action.d/sendmail-geoip-lines.conf index b7c1bf368..b36e49a7e 100644 --- a/fail2ban/action.d/sendmail-geoip-lines.conf +++ b/fail2ban/action.d/sendmail-geoip-lines.conf @@ -37,11 +37,11 @@ actionban = ( printf %%b "Subject: [Fail2Ban] : banned from " | cut -d':' -f2-` AS:`geoiplookup -f /usr/share/GeoIP/GeoIPASNum.dat "" | cut -d':' -f2-` hostname: \n\n - Lines containing failures of \n"; + Lines containing failures of (max )\n"; %(_grep_logs)s; printf %%b "\n Regards,\n - Fail2Ban" ) | /usr/sbin/sendmail -f + Fail2Ban" ) | [Init] diff --git a/fail2ban/action.d/sendmail-whois-ipjailmatches.conf b/fail2ban/action.d/sendmail-whois-ipjailmatches.conf index 06ea3a3e7..7790ec532 100644 --- a/fail2ban/action.d/sendmail-whois-ipjailmatches.conf +++ b/fail2ban/action.d/sendmail-whois-ipjailmatches.conf @@ -7,6 +7,7 @@ [INCLUDES] before = sendmail-common.conf + mail-whois-common.conf [Definition] @@ -27,11 +28,11 @@ actionban = printf %%b "Subject: [Fail2Ban] : banned from has just been banned by Fail2Ban after attempts against .\n\n Here is more information about :\n - `/usr/bin/whois `\n\n + `%(_whois_command)s`\n\n Matches for with failures IP:\n \n\n Regards,\n - Fail2Ban" | /usr/sbin/sendmail -f + Fail2Ban" | [Init] diff --git a/fail2ban/action.d/sendmail-whois-ipmatches.conf b/fail2ban/action.d/sendmail-whois-ipmatches.conf index 83bff1b40..e4717ca1b 100644 --- a/fail2ban/action.d/sendmail-whois-ipmatches.conf +++ b/fail2ban/action.d/sendmail-whois-ipmatches.conf @@ -7,6 +7,7 @@ [INCLUDES] before = sendmail-common.conf + mail-whois-common.conf [Definition] @@ -27,11 +28,11 @@ actionban = printf %%b "Subject: [Fail2Ban] : banned from has just been banned by Fail2Ban after attempts against .\n\n Here is more information about :\n - `/usr/bin/whois `\n\n + `%(_whois_command)s`\n\n Matches with failures IP:\n \n\n Regards,\n - Fail2Ban" | /usr/sbin/sendmail -f + Fail2Ban" | [Init] diff --git a/fail2ban/action.d/sendmail-whois-lines.conf b/fail2ban/action.d/sendmail-whois-lines.conf index 4b947cb2b..47ec6ed5f 100644 --- a/fail2ban/action.d/sendmail-whois-lines.conf +++ b/fail2ban/action.d/sendmail-whois-lines.conf @@ -7,6 +7,7 @@ [INCLUDES] before = sendmail-common.conf + mail-whois-common.conf helpers-common.conf [Definition] @@ -27,13 +28,13 @@ actionban = ( printf %%b "Subject: [Fail2Ban] : banned from has just been banned by Fail2Ban after attempts against .\n\n - Here is more information about :\n - `/usr/bin/whois || echo missing whois program`\n\n - Lines containing failures of \n"; + Here is more information about :\n" + %(_whois_command)s; + printf %%b "\nLines containing failures of (max )\n"; %(_grep_logs)s; printf %%b "\n Regards,\n - Fail2Ban" ) | /usr/sbin/sendmail -f + Fail2Ban" ) | [Init] diff --git a/fail2ban/action.d/sendmail-whois-matches.conf b/fail2ban/action.d/sendmail-whois-matches.conf index 015201351..08215ea7e 100644 --- a/fail2ban/action.d/sendmail-whois-matches.conf +++ b/fail2ban/action.d/sendmail-whois-matches.conf @@ -7,6 +7,7 @@ [INCLUDES] before = sendmail-common.conf + mail-whois-common.conf [Definition] @@ -27,11 +28,11 @@ actionban = printf %%b "Subject: [Fail2Ban] : banned from has just been banned by Fail2Ban after attempts against .\n\n Here is more information about :\n - `/usr/bin/whois `\n\n + `%(_whois_command)s`\n\n Matches:\n \n\n Regards,\n - Fail2Ban" | /usr/sbin/sendmail -f + Fail2Ban" | [Init] diff --git a/fail2ban/action.d/sendmail-whois.conf b/fail2ban/action.d/sendmail-whois.conf index 2fb01ed33..9e93cd327 100644 --- a/fail2ban/action.d/sendmail-whois.conf +++ b/fail2ban/action.d/sendmail-whois.conf @@ -7,6 +7,7 @@ [INCLUDES] before = sendmail-common.conf + mail-whois-common.conf [Definition] @@ -27,9 +28,9 @@ actionban = printf %%b "Subject: [Fail2Ban] : banned from has just been banned by Fail2Ban after attempts against .\n\n Here is more information about :\n - `/usr/bin/whois || echo missing whois program`\n + `%(_whois_command)s`\n Regards,\n - Fail2Ban" | /usr/sbin/sendmail -f + Fail2Ban" | [Init] diff --git a/fail2ban/action.d/sendmail.conf b/fail2ban/action.d/sendmail.conf index cf4209157..ad9e8d791 100644 --- a/fail2ban/action.d/sendmail.conf +++ b/fail2ban/action.d/sendmail.conf @@ -27,7 +27,7 @@ actionban = printf %%b "Subject: [Fail2Ban] : banned from has just been banned by Fail2Ban after attempts against .\n Regards,\n - Fail2Ban" | /usr/sbin/sendmail -f + Fail2Ban" | [Init] diff --git a/fail2ban/action.d/shorewall-ipset-proto6.conf b/fail2ban/action.d/shorewall-ipset-proto6.conf index 1ebcfb01f..45be0c0a1 100644 --- a/fail2ban/action.d/shorewall-ipset-proto6.conf +++ b/fail2ban/action.d/shorewall-ipset-proto6.conf @@ -47,15 +47,15 @@ [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = if ! ipset -quiet -name list f2b- >/dev/null; - then ipset -quiet -exist create f2b- hash:ip timeout ; + then ipset -quiet -exist create f2b- hash:ip timeout ; fi # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = ipset flush f2b- @@ -68,6 +68,8 @@ actionstop = ipset flush f2b- # actionban = ipset add f2b- timeout -exist +actionprolong = %(actionban)s + # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the # command is executed with Fail2Ban user rights. @@ -76,10 +78,8 @@ actionban = ipset add f2b- timeout -exist # actionunban = ipset del f2b- -exist -[Init] - -# Option: bantime -# Notes: specifies the bantime in seconds (handled internally rather than by fail2ban) +# Option: default-timeout +# Notes: specifies default timeout in seconds (handled default ipset timeout only) # Values: [ NUM ] Default: 600 -# -bantime = 600 + +default-timeout = 600 diff --git a/fail2ban/action.d/shorewall.conf b/fail2ban/action.d/shorewall.conf index 282b95afe..83d08d999 100644 --- a/fail2ban/action.d/shorewall.conf +++ b/fail2ban/action.d/shorewall.conf @@ -9,7 +9,7 @@ # connections. So if the attempter goes on trying using the same connection # he could even log in. In order to get the same behavior of the iptable # action (so that the ban is immediate) the /etc/shorewall/shorewall.conf -# file should me modified with "BLACKLISTNEWONLY=No". Note that as of +# file should be modified with "BLACKLISTNEWONLY=No". Note that as of # Shorewall 4.5.13 BLACKLISTNEWONLY is deprecated; however the equivalent # of BLACKLISTNEWONLY=No can now be achieved by setting BLACKLIST="ALL". # @@ -17,13 +17,13 @@ [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = diff --git a/fail2ban/action.d/smtp.py b/fail2ban/action.d/smtp.py index 9cdfe3274..5c27d0ff7 100644 --- a/fail2ban/action.d/smtp.py +++ b/fail2ban/action.d/smtp.py @@ -159,25 +159,25 @@ class SMTPAction(ActionBase): try: self._logSys.debug("Connected to SMTP '%s', response: %i: %s", self.host, *smtp.connect(self.host)) - if self.user and self.password: + if self.user and self.password: # pragma: no cover (ATM no tests covering that) smtp.login(self.user, self.password) failed_recipients = smtp.sendmail( self.fromaddr, self.toaddr.split(", "), msg.as_string()) - except smtplib.SMTPConnectError: + except smtplib.SMTPConnectError: # pragma: no cover self._logSys.error("Error connecting to host '%s'", self.host) raise - except smtplib.SMTPAuthenticationError: + except smtplib.SMTPAuthenticationError: # pragma: no cover self._logSys.error( "Failed to authenticate with host '%s' user '%s'", self.host, self.user) raise - except smtplib.SMTPException: + except smtplib.SMTPException: # pragma: no cover self._logSys.error( "Error sending mail to host '%s' from '%s' to '%s'", self.host, self.fromaddr, self.toaddr) raise else: - if failed_recipients: + if failed_recipients: # pragma: no cover self._logSys.warning( "Email to '%s' failed to following recipients: %r", self.toaddr, failed_recipients) @@ -186,7 +186,7 @@ class SMTPAction(ActionBase): try: self._logSys.debug("Disconnected from '%s', response %i: %s", self.host, *smtp.quit()) - except smtplib.SMTPServerDisconnected: + except smtplib.SMTPServerDisconnected: # pragma: no cover pass # Not connected def start(self): diff --git a/fail2ban/action.d/symbiosis-blacklist-allports.conf b/fail2ban/action.d/symbiosis-blacklist-allports.conf index c24a8e0ad..6fb7d0af5 100644 --- a/fail2ban/action.d/symbiosis-blacklist-allports.conf +++ b/fail2ban/action.d/symbiosis-blacklist-allports.conf @@ -10,13 +10,13 @@ before = iptables-common.conf [Definition] # Option: actionstart -# Notes.: command executed once at the start of Fail2Ban. +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). # Values: CMD # actionstart = # Option: actionstop -# Notes.: command executed once at the end of Fail2Ban +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) # Values: CMD # actionstop = diff --git a/fail2ban/action.d/xarf-login-attack.conf b/fail2ban/action.d/xarf-login-attack.conf index 2b135c432..f348b2c44 100644 --- a/fail2ban/action.d/xarf-login-attack.conf +++ b/fail2ban/action.d/xarf-login-attack.conf @@ -41,7 +41,12 @@ actionstop = actioncheck = -actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs} +actionban = oifs=${IFS}; + RESOLVER_ADDR="%(addr_resolver)s" + if [ "" -gt 0 ]; then echo "try to resolve $RESOLVER_ADDR"; fi + ADDRESSES=$(dig +short -t txt -q $RESOLVER_ADDR | tr -d '"') + IFS=,; ADDRESSES=$(echo $ADDRESSES) + IFS=${oifs} IP= FROM= SERVICE= @@ -51,26 +56,37 @@ actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP}; ADDRESSES=$(di PORT= DATE=`LC_ALL=C date --date=@