Permission-hardener broken

Support
1

Hi,
My permission hardener is broken. Whatever package I install it tells me these info when I reinstall a package:

Processing triggers for security-misc (3:37.5-1) ...
INFO: triggered security-misc: 'security-misc' security-misc DPKG_MAINTSCRIPT_NAME: 'postinst' $\@: 'triggered /usr' 2: '/usr'
/usr/libexec/security-misc/mmap-rnd-bits: INFO: Successfully written ASLR map config file:
/etc/sysctl.d/30_security-misc_aslr-mmap.conf
Running SUID Disabler and Permission Hardener... See also:
https://www.kicksecure.com/wiki/SUID_Disabler_and_Permission_Hardener
/var/lib/dpkg/info/security-misc.postinst: INFO: running: permission-hardener enable

INFO: fso_to_process: '/opt/' | counter_actual   : '1'
INFO: fso_to_process: '/opt/' | should_be_counter: ''
ERROR: counter does not check out.
INFO: fso_to_process: '/usr/bin/' | counter_actual   : '4'
INFO: fso_to_process: '/usr/bin/' | should_be_counter: ''
ERROR: counter does not check out.
INFO: fso_to_process: '/usr/lib64/' | counter_actual   : '0'
INFO: fso_to_process: '/usr/lib64/' | should_be_counter: ''
ERROR: counter does not check out.
INFO: fso_to_process: '/usr/lib/' | counter_actual   : '4'
INFO: fso_to_process: '/usr/lib/' | should_be_counter: ''
ERROR: counter does not check out.
INFO: fso_to_process: '/usr/local/bin/' | counter_actual   : '0'
INFO: fso_to_process: '/usr/local/bin/' | should_be_counter: ''
ERROR: counter does not check out.
INFO: fso_to_process: '/usr/local/lib/' | counter_actual   : '0'
INFO: fso_to_process: '/usr/local/lib/' | should_be_counter: ''
ERROR: counter does not check out.
INFO: fso_to_process: '/usr/local/sbin/' | counter_actual   : '0'
INFO: fso_to_process: '/usr/local/sbin/' | should_be_counter: ''
ERROR: counter does not check out.
INFO: fso_to_process: '/usr/sbin/' | counter_actual   : '1'
INFO: fso_to_process: '/usr/sbin/' | should_be_counter: ''
ERROR: counter does not check out.
INFO: To compare the current and previous permission modes:
  Install 'meld' (or preferred diff tool) for comparison of file mode changes:
    sudo apt install --no-install-recommends meld

  Use 'meld' or another diff tool to view the differences:
    meld /var/lib/permission-hardener/existing_mode/statoverride /var/lib/permission-hardener/new_mode/statoverride
ERROR: Exiting with non-zero exit code: '202'
/var/lib/dpkg/info/security-misc.postinst: ERROR: Permission hardening failed.
Processing triggers for man-db (2.11.2-2) ...
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 0 not upgraded.

Please help me to fix! Thanks!

2

Thanks for the bug report!

Temporary workaround:

Open file /usr/bin/permission-hardener with root rights.

sudoedit /usr/bin/permission-hardener

Look for line

if test ! "${should_be_counter}" = "${counter_actual}"; then

Comment out or delete this while code block.

  if test ! "${should_be_counter}" = "${counter_actual}"; then
    echo "INFO: fso_to_process: '${fso_to_process}' | counter_actual   : '${counter_actual}'"
    echo "INFO: fso_to_process: '${fso_to_process}' | should_be_counter: '${should_be_counter}'"
    exit_code=202
    echo "ERROR: counter does not check out." >&2
  fi

Save. That should workaround this bug for now.

This issue will be fixed in the near future through an upgrade.

3

This temporary workaround is just simply not showing error messages?

4

Yes.

And the workaround is not even required. Since permission-hardener failure does not break APT, there is no need for this workaround.

Meanwhile, you can safely ignore this warning.

5

I am using Gnome 42 with customized theme. When I ignore this warning, most of the icons are missing.
After I did what you suggested, all icons come back to work.
Please fix!

6

Highly unlikely that this is related.

7
8

This is now in the testers repository.

9

Maybe. But commenting out those lines is the only thing I changed.