astelm/telemt
1
0
Fork 0
mirror of https://github.com/telemt/telemt.git synced 2026-11-02 05:42:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

Conntrack: Firewall reconciliation process-owned&transactional

Browse Source
This commit is contained in:
Alexey
2026-09-25 19:35:31 +03:00
parent 26a574780e
commit c12c5c73c1
26 changed files with 2520 additions and 439 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/util/trusted_command.rs
+10 -1
View File
@@ -2,10 +2,12 @@ use std::os::unix::fs::{MetadataExt, PermissionsExt};
use std::path::{Path, PathBuf};
const TRUSTED_HELPER_DIRS: [&str; 4] = ["/usr/sbin", "/usr/bin", "/sbin", "/bin"];
const TRUSTED_HELPERS: [&str; 10] = [
const TRUSTED_HELPERS: [&str; 12] = [
"nft",
"iptables",
"iptables-restore",
"ip6tables",
"ip6tables-restore",
"conntrack",
"pfctl",
"systemctl",
@@ -69,6 +71,13 @@ mod tests {
assert!(resolve_trusted_helper("../bin/nft").is_none());
}
#[test]
fn privileged_helper_allowlist_accepts_exact_restore_names() {
assert!(TRUSTED_HELPERS.contains(&"iptables-restore"));
assert!(TRUSTED_HELPERS.contains(&"ip6tables-restore"));
assert!(!TRUSTED_HELPERS.contains(&"iptables-restore-wrapper"));
}
#[test]
fn writable_executable_is_not_trusted() {
let directory = tempfile::tempdir().unwrap();