fix(remove-system.map): skip read-only files instead of aborting#373
Open
maybebyte wants to merge 1 commit into
Open
fix(remove-system.map): skip read-only files instead of aborting#373maybebyte wants to merge 1 commit into
maybebyte wants to merge 1 commit into
Conversation
The read-only branch of the deletion loop calls `exit 0`, which terminates the whole script on the first non-writable System.map. Later writable copies (for example under /usr/src or /lib/modules) are then never shredded, and the "Done. Success." summary is skipped while the exit code still reports success -- a false all-clear that can leave a kernel symbol map on disk. Replace `exit 0` with `continue` so each read-only file is noted and the loop proceeds to the remaining locations. The script's exit code is unchanged, so callers are unaffected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
remove-system.mapshredsSystem.map*files because they expose a kernelsymbol-to-address map useful for exploitation. The deletion loop aborts on
the first read-only match, so writable copies in other locations are left on
disk while the run still reports success.
Changes
exit 0, whichterminates the whole script on the first non-writable
System.map(commonly/boot, which is often read-only). Later writable copies under/usr/src,/lib/modules, and/are then never shredded, and theDone. Success.summary is skipped even though the exit code reports success.
exit 0withcontinueso each read-only file is noted and theloop proceeds through the remaining locations. The exit code is unchanged.
Testing
exit 0the run stopsafter the first read-only entry (no summary printed); with
continueitprocesses the following writable entry and prints
Done. Success.shellcheckon the modified script: no new findings (only a pre-existingSC1091 info note on the unrelated
sourceline).Notes for reviewers
System.map(e.g. under/boot)is read-only, writable copies elsewhere that were previously skipped will now
be shredded — the tool's intended behavior.