How the tools work
What every tool has in common
Each tool is one bash script with its own page and manual page. They share a few commands, so you learn them once.
| Command | What it does |
|---|---|
check |
Tells you whether this machine is exposed. It changes nothing. Most tools run it when you give no command. |
hunt |
Looks for signs that the flaw was used. It changes nothing. |
mitigate |
Applies protection that you can undo. It needs root, and not every tool has one. |
rollback |
Undoes what mitigate changed. |
Type the command every time. Two tools do something else when you give none: php2shell-mitigate.sh and emudhra-mitigate.sh apply their protection by default.
The Claude Code extension tool also has update, keys, clean, block and unblock; its page explains each one.
Root and sudo
Commands that change the machine need root. Run them from a named admin account with sudo, for example sudo ./haproxy-check.sh mitigate, and not from a root login, because sudo records who made the change. If you forget, the tool stops and prints the exact sudo command to run, or says to run it as root when sudo is not installed. If you start a change from the root account while sudo is available, the tool prints a one-line note and carries on. PSF_NO_ROOT_NOTE=1 hides the note.
check and hunt run without root, but a plain account cannot read other users' files, protected logs or the container runtime. A hunt says so instead of calling the result clean, and a few exit with 2 when no log could be read. Run them with sudo for the full answer.
Tools that work per user, such as the Claude Code extension's update, keys and clean, should run as the account that uses the editor, not with sudo.
The four steps to follow, in order, are on the home page.
What mitigate does before it changes anything
- It copies every file it is about to edit.
- Where the service has its own checker (
nginx -t,haproxy -c,rsyslogd -N1,xmllintand so on), it checks the result with it, and puts the original back at once if the check fails. - It supports
--dry-run, which shows the change and makes none. - It reloads or restarts nothing unless you ask with
--reloador--restart. - It keeps its backups and a record for
rollbackunder/var/lib/psf-security-patches/, in a folder named for the tool.
Results and exit codes
Most tools use the same exit codes, so you can use them in scripts and monitoring.
| Code | Meaning |
|---|---|
| 0 | Nothing exposed, or nothing found. |
| 1 | Exposed, or an indicator was found. |
| 2 | Bad arguments, or something the tool needed could not be read. |
A hunt match tells you where to look. A clean hunt means none of the published indicators were found.
Settings
| Setting | Effect |
|---|---|
SCAN_CONTAINERS=0 |
Skip running docker and podman containers. By default a tool also checks them when you do not name a directory. |
STATE_DIR=/path |
Where a tool keeps its backups and rollback record. Each tool's page names its default. |
--dry-run |
Show what a change would do and change nothing. |
PSF_NO_ROOT_NOTE=1 |
Hide the one-line note that a change was started from the root account. |
Where things are
- The scripts:
/opt/psf-security-patches/, one folder for each product. - Manual pages:
man psf-security-patchesfor the overview, thenman psf-NAMEfor a tool.info psf-security-patcheshas all of them in one manual. - This documentation, offline:
/usr/share/doc/psf-security-patches/html/index.html(on RPM systems the folder ispsf-security-patches-<version>).
Terms such as CVE, CVSS, backport and indicator are explained in the glossary.
The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.
