FM / sbin

/snap/core20/2866/usr/sbin

Name	Size	Mode	Actions
aa-remove-unknown	3068	0755	edit dl rm
aa-status	8839	0755	edit dl rm
aa-teardown	139	0755	edit dl rm
add-shell	860	0755	edit dl rm
addgroup	37785	0755	edit dl rm
adduser	37785	0755	edit dl rm
agetty	69000	0755	edit dl rm
apparmor_parser	1526368	0755	edit dl rm
apparmor_status	8839	0755	edit dl rm
arpd	80144	0755	edit dl rm
arptables	220488	0755	edit dl rm
arptables-nft	220488	0755	edit dl rm
arptables-nft-restore	220488	0755	edit dl rm
arptables-nft-save	220488	0755	edit dl rm
arptables-restore	220488	0755	edit dl rm
arptables-save	220488	0755	edit dl rm
badblocks	35144	0755	edit dl rm
blkdeactivate	14837	0755	edit dl rm
blkdiscard	35048	0755	edit dl rm
blkid	121096	0755	edit dl rm
blkzone	71912	0755	edit dl rm
blockdev	67816	0755	edit dl rm
bridge	104760	0755	edit dl rm
capsh	31032	0755	edit dl rm
cfdisk	105048	0755	edit dl rm
chcpu	47336	0755	edit dl rm
chgpasswd	67792	0755	edit dl rm
chmem	63720	0755	edit dl rm
chpasswd	59600	0755	edit dl rm
chroot	43352	0755	edit dl rm
cpgr	61784	0755	edit dl rm
cppw	61784	0755	edit dl rm
cryptdisks_start	1544	0755	edit dl rm
cryptdisks_stop	844	0755	edit dl rm
cryptsetup	138792	0755	edit dl rm
cryptsetup-reencrypt	107848	0755	edit dl rm
ctrlaltdel	39144	0755	edit dl rm
debugfs	231224	0755	edit dl rm
delgroup	16495	0755	edit dl rm
deluser	16495	0755	edit dl rm
depmod	170352	0755	edit dl rm
devlink	154080	0755	edit dl rm
dhclient	521200	0755	edit dl rm
dhclient-script	16304	0755	edit dl rm
dmsetup	175128	0755	edit dl rm
dmstats	175128	0755	edit dl rm
dosfsck	59472	0755	edit dl rm
dosfslabel	55376	0755	edit dl rm
dumpe2fs	31112	0755	edit dl rm
e2freefrag	18816	0755	edit dl rm
e2fsck	335064	0755	edit dl rm
e2image	43400	0755	edit dl rm
e2label	109112	0755	edit dl rm
e2mmpstatus	31112	0755	edit dl rm
e2scrub	7296	0755	edit dl rm
e2scrub_all	5395	0755	edit dl rm
e2undo	22912	0755	edit dl rm
e4crypt	31104	0755	edit dl rm
e4defrag	35128	0755	edit dl rm
ebtables	220488	0755	edit dl rm
ebtables-nft	220488	0755	edit dl rm
ebtables-nft-restore	220488	0755	edit dl rm
ebtables-nft-save	220488	0755	edit dl rm
ebtables-restore	220488	0755	edit dl rm
ebtables-save	220488	0755	edit dl rm
faillock	14488	0755	edit dl rm
fatlabel	55376	0755	edit dl rm
fdformat	35048	0755	edit dl rm
fdisk	153880	0755	edit dl rm
filefrag	18768	0755	edit dl rm
findfs	14568	0755	edit dl rm
fsck	55576	0755	edit dl rm
fsck.cramfs	39176	0755	edit dl rm
fsck.ext2	335064	0755	edit dl rm
fsck.ext3	335064	0755	edit dl rm
fsck.ext4	335064	0755	edit dl rm
fsck.fat	59472	0755	edit dl rm
fsck.minix	125184	0755	edit dl rm
fsck.msdos	59472	0755	edit dl rm
fsck.vfat	59472	0755	edit dl rm
fsfreeze	14568	0755	edit dl rm
fstab-decode	14648	0755	edit dl rm
fstrim	71912	0755	edit dl rm
genl	84264	0755	edit dl rm
getcap	14648	0755	edit dl rm
getpcaps	14648	0755	edit dl rm
getty	69000	0755	edit dl rm
groupadd	93136	0755	edit dl rm
groupdel	88848	0755	edit dl rm
groupmems	63736	0755	edit dl rm
groupmod	97136	0755	edit dl rm
grpck	63672	0755	edit dl rm
grpconv	59448	0755	edit dl rm
grpunconv	59448	0755	edit dl rm
halt	1119856	0755	edit dl rm
hwclock	104808	0755	edit dl rm
iconvconfig	31128	0755	edit dl rm
init	1849992	0755	edit dl rm
insmod	170352	0755	edit dl rm
installkernel	2638	0755	edit dl rm
integritysetup	61672	0755	edit dl rm
invoke-rc.d	17042	0755	edit dl rm
ip	718896	0755	edit dl rm
ip6tables	99296	0755	edit dl rm
ip6tables-apply	7057	0755	edit dl rm
ip6tables-legacy	99296	0755	edit dl rm
ip6tables-legacy-restore	99296	0755	edit dl rm
ip6tables-legacy-save	99296	0755	edit dl rm
ip6tables-nft	220488	0755	edit dl rm
ip6tables-nft-restore	220488	0755	edit dl rm
ip6tables-nft-save	220488	0755	edit dl rm
ip6tables-restore	99296	0755	edit dl rm
ip6tables-restore-translate	220488	0755	edit dl rm
ip6tables-save	99296	0755	edit dl rm
ip6tables-translate	220488	0755	edit dl rm
iptables	99296	0755	edit dl rm
iptables-apply	7057	0755	edit dl rm
iptables-legacy	99296	0755	edit dl rm
iptables-legacy-restore	99296	0755	edit dl rm
iptables-legacy-save	99296	0755	edit dl rm
iptables-nft	220488	0755	edit dl rm
iptables-nft-restore	220488	0755	edit dl rm
iptables-nft-save	220488	0755	edit dl rm
iptables-restore	99296	0755	edit dl rm
iptables-restore-translate	220488	0755	edit dl rm
iptables-save	99296	0755	edit dl rm
iptables-translate	220488	0755	edit dl rm
isosize	30952	0755	edit dl rm
killall5	27016	0755	edit dl rm
ldattach	35048	0755	edit dl rm
ldconfig	387	0755	edit dl rm
ldconfig.real	1053768	0755	edit dl rm
logsave	14496	0755	edit dl rm
losetup	112992	0755	edit dl rm
lsmod	170352	0755	edit dl rm
luksformat	3401	0755	edit dl rm
mkdosfs	35328	0755	edit dl rm
mke2fs	137848	0755	edit dl rm
mkfs	14568	0755	edit dl rm
mkfs.bfs	35048	0755	edit dl rm
mkfs.cramfs	43168	0755	edit dl rm
mkfs.ext2	137848	0755	edit dl rm
mkfs.ext3	137848	0755	edit dl rm
mkfs.ext4	137848	0755	edit dl rm
mkfs.fat	35328	0755	edit dl rm
mkfs.minix	108784	0755	edit dl rm
mkfs.msdos	35328	0755	edit dl rm
mkfs.vfat	35328	0755	edit dl rm
mkhomedir_helper	22704	0755	edit dl rm
mklost+found	14648	0755	edit dl rm
mkswap	108784	0755	edit dl rm
modinfo	170352	0755	edit dl rm
modprobe	170352	0755	edit dl rm
netplan	798	0755	edit dl rm
newusers	101168	0755	edit dl rm
nfnl_osf	18736	0755	edit dl rm
nologin	14640	0755	edit dl rm
pam-auth-update	20335	0755	edit dl rm
pam_extrausers_chkpwd	43168	2755	edit dl rm
pam_extrausers_update	43168	0755	edit dl rm
pam_getenv	2890	0755	edit dl rm
pam_tally	14504	0755	edit dl rm
pam_tally2	18600	0755	edit dl rm
pam_timestamp_check	14488	0755	edit dl rm
pivot_root	14568	0755	edit dl rm
poweroff	1119856	0755	edit dl rm
pwck	59568	0755	edit dl rm
pwconv	55344	0755	edit dl rm
pwunconv	55352	0755	edit dl rm
raw	14568	0755	edit dl rm
readprofile	22792	0755	edit dl rm
reboot	1119856	0755	edit dl rm
remove-shell	904	0755	edit dl rm
resize2fs	67968	0755	edit dl rm
rfkill	51432	0755	edit dl rm
rmmod	170352	0755	edit dl rm
rmt	59952	0755	edit dl rm
rmt-tar	59952	0755	edit dl rm
rtacct	49448	0755	edit dl rm
rtcwake	47336	0755	edit dl rm
rtmon	80120	0755	edit dl rm
runlevel	1119856	0755	edit dl rm
runuser	67816	0755	edit dl rm
service	9262	0755	edit dl rm
setcap	14648	0755	edit dl rm
sfdisk	141544	0755	edit dl rm
shadowconfig	885	0755	edit dl rm
shutdown	1119856	0755	edit dl rm
sshd	884520	0755	edit dl rm
start-stop-daemon	48456	0755	edit dl rm
sulogin	51432	0755	edit dl rm
swaplabel	18664	0755	edit dl rm
swapoff	22760	0755	edit dl rm
swapon	51432	0755	edit dl rm
switch_root	14568	0755	edit dl rm
sysctl	30960	0755	edit dl rm
tarcat	936	0755	edit dl rm
tc	542160	0755	edit dl rm
telinit	1119856	0755	edit dl rm
tipc	129264	0755	edit dl rm
tune2fs	109112	0755	edit dl rm
tzconfig	106	0755	edit dl rm
unix_chkpwd	43160	2755	edit dl rm
unix_update	43160	0755	edit dl rm
update-ca-certificates	5418	0755	edit dl rm
update-mime	9402	0755	edit dl rm
update-passwd	35392	0755	edit dl rm
update-rc.d	17161	0755	edit dl rm
useradd	147160	0755	edit dl rm
userdel	101264	0755	edit dl rm
usermod	142840	0755	edit dl rm
veritysetup	53064	0755	edit dl rm
vigr	70200	0755	edit dl rm
vipw	70200	0755	edit dl rm
visudo	223432	0755	edit dl rm
wipefs	47336	0755	edit dl rm
wpa_action	1735	0755	edit dl rm
wpa_cli	155872	0755	edit dl rm
wpa_supplicant	2901328	0755	edit dl rm
xtables-legacy-multi	99296	0755	edit dl rm
xtables-monitor	220488	0755	edit dl rm
xtables-nft-multi	220488	0755	edit dl rm
zic	63784	0755	edit dl rm
zramctl	117088	0755	edit dl rm

Edit: /snap/core20/2866/usr/sbin/iptables-apply (7057B)

#!/bin/bash
# iptables-apply -- a safer way to update iptables remotely
#
# Usage:
#   iptables-apply [-hV] [-t timeout] [-w savefile] {[rulesfile]|-c [runcmd]}
#
# Versions:
#   * 1.0 Copyright 2006 Martin F. Krafft <madduck@madduck.net>
#         Original version
#   * 1.1 Copyright 2010 GW <gw.2010@tnode.com or http://gw.tnode.com/>
#         Added parameter -c (run command)
#         Added parameter -w (save successfully applied rules to file)
#         Major code cleanup
#
# Released under the terms of the Artistic Licence 2.0
#
set -eu

PROGNAME="${0##*/}"
VERSION=1.1

### Default settings

DEF_TIMEOUT=10

MODE=0  # apply rulesfile mode
# MODE=1  # run command mode

case "$PROGNAME" in
	(*6*)
		SAVE=ip6tables-save
		RESTORE=ip6tables-restore
		DEF_RULESFILE="/etc/network/ip6tables.up.rules"
		DEF_SAVEFILE="$DEF_RULESFILE"
		DEF_RUNCMD="/etc/network/ip6tables.up.run"
		;;
	(*)
		SAVE=iptables-save
		RESTORE=iptables-restore
		DEF_RULESFILE="/etc/network/iptables.up.rules"
		DEF_SAVEFILE="$DEF_RULESFILE"
		DEF_RUNCMD="/etc/network/iptables.up.run"
		;;
esac

### Functions

function blurb() {
	cat <<-__EOF__
	$PROGNAME $VERSION -- a safer way to update iptables remotely
	__EOF__
}

function copyright() {
	cat <<-__EOF__
	$PROGNAME has been published under the terms of the Artistic Licence 2.0.

Original version - Copyright 2006 Martin F. Krafft <madduck@madduck.net>.
	Version 1.1 - Copyright 2010 GW <gw.2010@tnode.com or http://gw.tnode.com/>.
	__EOF__
}

function about() {
	blurb
	echo
	copyright
}

function usage() {
	blurb
	echo
	cat <<-__EOF__
	Usage:
	  $PROGNAME [-hV] [-t timeout] [-w savefile] {[rulesfile]|-c [runcmd]}

The script will try to apply a new rulesfile (as output by iptables-save,
	read by iptables-restore) or run a command to configure iptables and then
	prompt the user whether the changes are okay. If the new iptables rules cut
	the existing connection, the user will not be able to answer affirmatively.
	In this case, the script rolls back to the previous working iptables rules
	after the timeout expires.

Successfully applied rules can also be written to savefile and later used
	to roll back to this state. This can be used to implement a store last good
	configuration mechanism when experimenting with an iptables setup script:
	  $PROGNAME -w $DEF_SAVEFILE -c $DEF_RUNCMD

When called as ip6tables-apply, the script will use ip6tables-save/-restore
	and IPv6 default values instead. Default value for rulesfile is
	'$DEF_RULESFILE'.

Options:

-t seconds, --timeout seconds
	  Specify the timeout in seconds (default: $DEF_TIMEOUT).
	-w savefile, --write savefile
	  Specify the savefile where successfully applied rules will be written to
	  (default if empty string is given: $DEF_SAVEFILE).
	-c runcmd, --command runcmd
	  Run command runcmd to configure iptables instead of applying a rulesfile
	  (default: $DEF_RUNCMD).
	-h, --help
	  Display this help text.
	-V, --version
	  Display version information.

__EOF__
}

function checkcommands() {
	for cmd in "${COMMANDS[@]}"; do
		if ! command -v "$cmd" >/dev/null; then
			echo "Error: needed command not found: $cmd" >&2
			exit 127
		fi
	done
}

function revertrules() {
	echo -n "Reverting to old iptables rules... "
	"$RESTORE" <"$TMPFILE"
	echo "done."
}

### Parsing and checking parameters

TIMEOUT="$DEF_TIMEOUT"
SAVEFILE=""

SHORTOPTS="t:w:chV";
LONGOPTS="timeout:,write:,command,help,version";

OPTS=$(getopt -s bash -o "$SHORTOPTS" -l "$LONGOPTS" -n "$PROGNAME" -- "$@") || exit $?
for opt in $OPTS; do
	case "$opt" in
		(-*)
			unset OPT_STATE
			;;
		(*)
			case "${OPT_STATE:-}" in
				(SET_TIMEOUT) eval TIMEOUT=$opt;;
				(SET_SAVEFILE)
					eval SAVEFILE=$opt
					[ -z "$SAVEFILE" ] && SAVEFILE="$DEF_SAVEFILE"
					;;
			esac
			;;
	esac

# Validate parameters
if [ "$TIMEOUT" -ge 0 ] 2>/dev/null; then
	TIMEOUT=$(($TIMEOUT))
else
	echo "Error: timeout must be a positive number" >&2
	exit 1
fi

if [ -n "$SAVEFILE" -a -e "$SAVEFILE" -a ! -w "$SAVEFILE" ]; then
	echo "Error: savefile not writable: $SAVEFILE" >&2
	exit 8
fi

case "$MODE" in
	(1)
		# Treat parameter as runcmd (run command mode)
		RUNCMD="${1:-$DEF_RUNCMD}"
		if [ ! -x "$RUNCMD" ]; then
			echo "Error: runcmd not executable: $RUNCMD" >&2
			exit 6
		fi

# Needed commands
		COMMANDS=(mktemp "$SAVE" "$RESTORE" "$RUNCMD")
		checkcommands
		;;
	(*)
		# Treat parameter as rulesfile (apply rulesfile mode)
		RULESFILE="${1:-$DEF_RULESFILE}";
		if [ ! -r "$RULESFILE" ]; then
			echo "Error: rulesfile not readable: $RULESFILE" >&2
			exit 2
		fi

# Needed commands
		COMMANDS=(mktemp "$SAVE" "$RESTORE")
		checkcommands
		;;
esac

### Begin work

# Store old iptables rules to temporary file
TMPFILE=`mktemp /tmp/$PROGNAME-XXXXXXXX`
trap "rm -f $TMPFILE" EXIT HUP INT QUIT ILL TRAP ABRT BUS \
		      FPE USR1 SEGV USR2 PIPE ALRM TERM

if ! "$SAVE" >"$TMPFILE"; then
	# An error occured
	if ! grep -q ipt /proc/modules 2>/dev/null; then
		echo "Error: iptables support lacking from the kernel" >&2
		exit 3
	else
		echo "Error: unknown error saving old iptables rules: $TMPFILE" >&2
		exit 4
	fi
fi

# Legacy to stop the fail2ban daemon if present
[ -x /etc/init.d/fail2ban ] && /etc/init.d/fail2ban stop

# Configure iptables
case "$MODE" in
	(1)
		# Run command in background and kill it if it times out
		echo -n "Running command '$RUNCMD'... "
		"$RUNCMD" &
		CMD_PID=$!
		( sleep "$TIMEOUT"; kill "$CMD_PID" 2>/dev/null; exit 0 ) &
		CMDTIMEOUT_PID=$!
		if ! wait "$CMD_PID"; then
			echo "failed."
			echo "Error: unknown error running command: $RUNCMD" >&2
			revertrules
			exit 7
		else
			echo "done."
		fi
		;;
	(*)
		# Apply iptables rulesfile
		echo -n "Applying new iptables rules from '$RULESFILE'... "
		if ! "$RESTORE" <"$RULESFILE"; then
			echo "failed."
			echo "Error: unknown error applying new iptables rules: $RULESFILE" >&2
			revertrules
			exit 5
		else
			echo "done."
		fi
		;;
esac

# Prompt user for confirmation
echo -n "Can you establish NEW connections to the machine? (y/N) "

read -n1 -t "$TIMEOUT" ret 2>&1 || :
case "${ret:-}" in
	(y*|Y*)
		# Success
		echo

if [ ! -z "$SAVEFILE" ]; then
			# Write successfully applied rules to the savefile
			echo "Writing successfully applied rules to '$SAVEFILE'..."
			if ! "$SAVE" >"$SAVEFILE"; then
				echo "Error: unknown error writing successfully applied rules: $SAVEFILE" >&2
				exit 9
			fi
		fi

echo "... then my job is done. See you next time."
		;;
	(*)
		# Failed
		echo
		if [ -z "${ret:-}" ]; then
			echo "Timeout! Something happened (or did not). Better play it safe..."
		else
			echo "No affirmative response! Better play it safe..."
		fi
		revertrules
		exit 255
		;;
esac

# Legacy to start the fail2ban daemon again
[ -x /etc/init.d/fail2ban ] && /etc/init.d/fail2ban start

exit 0

# vim:noet:sw=8

cmd: