[gentoo-portage-dev] [PATCH 2/2] bin/install-qa-check.d: add new 90bad-bin-group-write QA check.

[Michael Orlitzky]

System executables that are writable by a non-root user pose a
security risk. Anyone who can write to an executable can change its
behavior. If that executable is later run with elevated privileges
(say, by root, when the machine starts), then the non-root user can
escalate his own privileges to those of the person running the
modified executable.

The 90bad-bin-owner check already addresses one cause for a non-root
user to be able to modify an executable: because he owns it. This
commit adds another check, to ensure that no non-root *groups* have
write access to any system executables. On a "normal" system, all
system executables should belong to the super-user's group. To avoid
false-positives, non-"normal" systems (like prefix) are skipped.

Closes: https://bugs.gentoo.org/629398
---
 bin/install-qa-check.d/90bad-bin-group-write | 49 ++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 bin/install-qa-check.d/90bad-bin-group-write

diff --git a/bin/install-qa-check.d/90bad-bin-group-write b/bin/install-qa-check.d/90bad-bin-group-write
new file mode 100644
index 000000000..3c5021e0d
--- /dev/null
+++ b/bin/install-qa-check.d/90bad-bin-group-write
@@ -0,0 +1,49 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+bad_bin_group_write_check() {
+	# Warn about globally-installed executables (in /bin, /usr/bin, /sbin,
+	# /usr/sbin, or /opt/bin) that are group-writable by a nonzero GID.
+
+	# This check doesn't work on non-root prefix installations at
+	# the moment, because every executable therein is owned by a
+	# nonzero GID.
+	[[ "${EUID}" -ne "0" || "${PORTAGE_INST_UID}" -ne "0" ]] && return
+
+	local d f found=()
+
+	for d in "${ED%/}/opt/bin" "${ED%/}/bin"  "${ED%/}/usr/bin" \
+							   "${ED%/}/sbin" "${ED%/}/usr/sbin"; do
+		[[ -d "${d}" ]] || continue
+
+		# Read the results of the "find" command into the "found" bash
+		# array. Use -L to catch symlinks whose targets are vulnerable,
+		# even though it won't catch ABSOLUTE symlinks until the package
+		# is RE-installed (the first time around, the target won't exist).
+		# We match the GID and not the name "root" here because (for
+		# example) on FreeBSD, the superuser group is "wheel".
+		# We avoid listing setgid executables because -- even though they're
+		# super sketchy -- their non-root group is intentional.
+		while read -r -d '' f; do
+			found+=( "${f}" )
+		done < <(find -L "${d}"   \
+					-maxdepth 1   \
+					-type f       \
+					-perm /g+w    \
+					! -gid 0      \
+					! -perm -2000 \
+					-print0)
+	done
+
+	if [[ ${found[@]} ]]; then
+		eqawarn "system executables group-writable by nonzero gid:"
+		for f in "${found[@]}"; do
+			# Strip off the leading destdir before outputting the path,
+			# but leave the prefix if there is one.
+			eqawarn "  ${f#${D%/}/}"
+		done
+	fi
+}
+
+bad_bin_group_write_check
+:
-- 
2.16.4