Re: [gentoo-portage-dev] [PATCH 1/2] bin/install-qa-check.d: add new 90bad-bin-owner QA check.

[Michał Górny]

W dniu nie, 29.07.2018 o godzinie 13∶37 -0400, użytkownik Michael
Orlitzky napisał:
> System executables that are not owned by root pose a security
> risk. The owner of the executable is free to modify it at any time;
> so, for example, he can change a daemon's behavior to make it
> malicious before the next time the service is started (usually by
> root).
>
> On a "normal" system, there is no good reason why the superuser should
> not own every system executable. This commit adds a new install-time
> check that reports any such binaries with a QA warning. To avoid false
> positives, non-"normal" systems (like prefix) are skipped at the moment.
>
> Bug: https://bugs.gentoo.org/629398
> ---
>  bin/install-qa-check.d/90bad-bin-owner | 38 ++++++++++++++++++++++++++++++++++
>  1 file changed, 38 insertions(+)
>  create mode 100644 bin/install-qa-check.d/90bad-bin-owner
>
> diff --git a/bin/install-qa-check.d/90bad-bin-owner b/bin/install-qa-check.d/90bad-bin-owner
> new file mode 100644
> index 000000000..188d67a51
> --- /dev/null
> +++ b/bin/install-qa-check.d/90bad-bin-owner
> @@ -0,0 +1,38 @@
> +# Copyright 1999-2018 Gentoo Foundation
> +# Distributed under the terms of the GNU General Public License v2
> +
> +bad_bin_owner_check() {
> +	# Warn about globally-installed executables (in /bin, /usr/bin, /sbin,
> +	# or /usr/sbin) that are owned by a nonzero UID.
> +
> +	# This check doesn't work on non-root prefix installations at
> +	# the moment, because every executable therein is owned by a
> +	# nonzero UID.
> +	[[ "${EUID}" -ne "0" || "${PORTAGE_INST_UID}" -ne "0" ]] && return
> +
> +	local d f found=()
> +
> +	for d in "${ED%/}/bin" "${ED%/}/usr/bin" "${ED%/}/sbin" "${ED%/}/usr/sbin"; do

I think you should include /opt/bin as well.  Or maybe simply all
locations on ${PATH}.

> +		[[ -d "${d}" ]] || continue
> +
> +		# Read the results of the "find" command into the "found" bash array.
> +		# Use -L to catch symlinks whose targets are owned by a non-root user,
> +		# even though it won't catch ABSOLUTE symlinks until the package
> +		# is RE-installed (the first time around, the target won't exist).
> +		while read -r -d '' f; do
> +			found+=( "${f}" )
> +		done < <(find -L "${d}" -maxdepth 1 -type f ! -uid 0 -print0)
> +
> +		if [[ ${found[@]} ]]; then
> +			eqawarn "system executables owned by nonzero uid:"
> +			for f in "${found[@]}"; do
> +				# Strip off the leading destdir before outputting the path,
> +				# but leave the prefix if there is one.
> +				eqawarn "  ${f#${D%/}/}"
> +			done
> +		fi
> +	done
> +}
> +
> +bad_bin_owner_check
> +:

-- 
Best regards,
Michał Górny