From 45ed5e89c1951fca282482af16cab560e64fc5d7 Mon Sep 17 00:00:00 2001
From: konsthol <konsthol@konsthol.eu>
Date: Sat, 2 Sep 2023 00:21:20 +0300
Subject: [PATCH] This should work until december 2013.

---
 harden | 34 ++++++++++++++--------------------
 1 file changed, 14 insertions(+), 20 deletions(-)

diff --git a/harden b/harden
index 6d3c665..e0c49f4 100755
--- a/harden
+++ b/harden
@@ -315,27 +315,23 @@ EOF
     [[ -f /home/centos/docker-compose.yml ]] && sudo mv /home/centos/docker-compose.yml /home/secdep/docker-compose.yml
     [[ -f /home/fedora/docker-compose.yml ]] && sudo mv /home/fedora/docker-compose.yml /home/secdep/docker-compose.yml
     [[ -f /home/ubuntu/docker-compose.yml ]] && sudo mv /home/ubuntu/docker-compose.yml /home/secdep/docker-compose.yml
-    # Not running chown in time? only when there is an if before
-    sudo chown secdep:secdep /home/secdep/docker-compose.yml
-    # [[ -f /home/secdep/docker-compose.yml ]] && sudo chown secdep:secdep /home/secdep/docker-compose.yml
+    # Since FileDeployment does not work and we used ScriptFileDeployment which might make the file owned by another user
+    # we need to make sure the file is owned by the secdep user.
+    # When using [[ -f /home/secdep/docker-compose.yml ]] && sudo chown secdep:secdep /home/secdep/docker-compose.yml
+    # it doesn't get executed somehow so we'll send the "no such file or directory" error to /dev/null
+    sudo chown secdep:secdep /home/secdep/docker-compose.yml > /dev/null 2>&1
     # Since FileDeployment does not work and we used ScriptFileDeployment which automatically makes the file executable
-    # we need to make sure the file is not executable
-    # Not running chmod in time? only when there is an if before
-    sudo chmod -x /home/secdep/docker-compose.yml
-    # [[ -f /home/secdep/docker-compose.yml ]] && sudo chmod -x /home/secdep/docker-compose.yml
-    # Make sure docker is disabled after
-    # having installed docker-compose, to make sure
-    # only rootless docker is used
-    # sudo systemctl disable --now docker.service docker.socket
+    # we need to make sure the file is not executable.
+    # when using [[ -f /home/secdep/docker-compose.yml ]] && sudo chmod -x /home/secdep/docker-compose.yml
+    # it doesn't get executed somehow so we'll send the "no such file or directory" error to /dev/null
+    sudo chmod -x /home/secdep/docker-compose.yml > /dev/null 2>&1
     sudo machinectl shell secdep@ /bin/bash -c 'curl -SL https://github.com/docker/compose/releases/download/v2.20.3/docker-compose-linux-x86_64 -o /home/secdep/bin/docker-compose'
     sudo machinectl shell secdep@ /bin/bash -c 'chmod +x /home/secdep/bin/docker-compose'
-    # Check if there is a docker-compose.yml file in the user's home directory and run it if there is
-    sudo machinectl shell secdep@ "$(which bash)" -c 'DOCKER_HOST=unix:///run/user/$UID/docker.sock /home/secdep/bin/docker-compose -f /home/secdep/docker-compose.yml up -d'
+    ## No immediate way to check if the docker-compose.yml file exists and is readable
+    ## so we'll just try to run it and if it doesn't exist or is not readable it will error out
+    sudo machinectl shell secdep@ "$(which bash)" -c '[[ -f "$HOME/docker-compose.yml" ]] && DOCKER_HOST=unix:///run/user/$UID/docker.sock /home/secdep/bin/docker-compose -f /home/secdep/docker-compose.yml up -d'
     # Read the docker-compose.yml file for port mappings to add to the firewall
-    ## Check if we can use docker-compose config for that unless we have no access to the output
-    # sudo machinectl shell secdep@ "$(which bash)" -c 'DOCKER_HOST=unix:///run/user/$UID/docker.sock /home/secdep/bin/docker-compose -f /home/secdep/docker-compose.yml config'
-    # [[ -f /home/secdep/docker-compose.yml ]] && sudo PORTS="$(grep '[0-9]:[0-9]' /home/secdep/docker-compose.yml | rev | cut -d':' -f1 | rev | grep -Eow '[[:digit:]]+' | tr '\n' ' ')" || PORTS=""
-    CMD_PORTS="cat /home/secdep/docker-compose.yml | grep -A1 ports | grep '[0-9]:[0-9]' | rev | cut -d':' -f1 | rev | grep -Eow '[[:digit:]]+' | tr '\n' ' '"
+    CMD_PORTS="cat /home/secdep/docker-compose.yml | sed '/^[[:space:]]*$/d' | grep -A1 ports | grep '[0-9]:[0-9]' | rev | cut -d':' -f1 | rev | grep -Eow '[[:digit:]]+' | tr '\n' ' '"
     sudo -E runuser - secdep -c "$CMD_PORTS" > /dev/null 2>&1 && PORTS="$(sudo -E runuser - secdep -c "$CMD_PORTS")" || PORTS=""
     # Loop through the ports in the PORTS variable
     if [[ -n "$PORTS" ]]; then
@@ -355,9 +351,6 @@ EOF
             esac
         done
     fi
-    # sudo machinectl shell secdep@ /bin/bash -c 'DOCKER_HOST=unix:///run/user/$UID/docker.sock docker-compose -f /home/secdep/docker-compose.yml up -d'
-    # sudo machinectl shell secdep@ /bin/bash -c '[[ -f "$HOME/docker-compose.yml" ]] && docker-compose -f "$HOME/docker-compose.yml" up -d'
-    # sudo -u secdep bash -c '[[ -f "$HOME/docker-compose.yml" ]] && docker-compose -f "$HOME/docker-compose.yml" up -d'
     # Portainer is a docker image that provides a web interface for docker
     # which will be installed and run on port 9000 by default to make it easier to manage docker
     # CMD1="docker volume create portainer_data # Create a docker volume for portainer"
@@ -524,6 +517,7 @@ function enableServices {
     # only rootless docker is used
 }
 
+# Sometimes the user is not deleted after the script is run
 function deleteRemainingUsers {
     # Delete possible remaining users
     cat << EOF | sudo tee /root/delete_users.sh