packaging/debian/stratoshark.postinst.in

   1 #!/bin/sh
   2
   3 set -e
   4
   5 # In order to capture system calls via falcosecurity-scap-dkms, we
   6 # currently need read+write access to /dev/scap* and read access to
   7 # various files under /proc, including /proc/<pid>/*, similar to
   8 # the requirements described at
   9 # https://github.com/draios/sysdig/wiki/How%20to%20Install%20Sysdig%20for%20Linux#use-sysdig-as-non-root
  10 #
  11 # Provide an option to install falcodump setuid root for now.
  12 # Hopefully at some point we'll be able to switch to capabilities.
  13 # https://falco.org/docs/install-operate/running/#least-privileged
  14
  15 # There's no corresponding stratoshark.postrm script because the "scap" group
  16 # might be shared with falcosecurity-scap-dkms, so we don't want to
  17 # remove it here.
  18 # Also, there are arguments against removing groups in general:
  19 # https://wiki.debian.org/AccountHandlingInMaintainerScripts
  20
  21 . /usr/share/debconf/confmodule
  22 PROGRAM=$(dpkg-divert --truename /usr/lib/@DEB_HOST_MULTIARCH@/stratoshark/extcap/falcodump)
  23 GROUP=scap
  24
  25 if ! dpkg-statoverride --list $PROGRAM > /dev/null; then
  26     db_get stratoshark/install-setuid
  27     if [ -e "$PROGRAM" ]; then
  28         if [ "$RET" = "false" ] ; then
  29             chown root:root $PROGRAM
  30             chmod u=rwx,go=rx $PROGRAM
  31         else
  32             if ! addgroup --quiet --system $GROUP; then
  33                 if ! getent group $GROUP > /dev/null; then
  34                     db_input high stratoshark/addgroup-failed || true
  35                     db_go
  36                     exit 1
  37                 else
  38                     db_input high stratoshark/group-is-user-group || true
  39                     db_go
  40                 fi
  41             fi
  42             chown root:$GROUP $PROGRAM
  43             chmod u=rwxs,g=rx,o=r $PROGRAM
  44         fi
  45     fi
  46 else
  47     dpkg-statoverride --list $PROGRAM
  48 fi
  49
  50 #DEBHELPER#