1 |
System executables that are writable by a non-root user pose a |
2 |
security risk. Anyone who can write to an executable can change its |
3 |
behavior. If that executable is later run with elevated privileges |
4 |
(say, by root, when the machine starts), then the non-root user can |
5 |
escalate his own privileges to those of the person running the |
6 |
modified executable. |
7 |
|
8 |
The 90bad-bin-owner check already addresses one cause for a non-root |
9 |
user to be able to modify an executable: because he owns it. This |
10 |
commit adds another check, to ensure that no non-root *groups* have |
11 |
write access to any system executables. On a "normal" system, all |
12 |
system executables should belong to the super-user's group. To avoid |
13 |
false-positives, non-"normal" systems (like prefix) are skipped. |
14 |
|
15 |
Closes: https://bugs.gentoo.org/629398 |
16 |
--- |
17 |
bin/install-qa-check.d/90bad-bin-group-write | 40 ++++++++++++++++++++++++++++ |
18 |
1 file changed, 40 insertions(+) |
19 |
create mode 100644 bin/install-qa-check.d/90bad-bin-group-write |
20 |
|
21 |
diff --git a/bin/install-qa-check.d/90bad-bin-group-write b/bin/install-qa-check.d/90bad-bin-group-write |
22 |
new file mode 100644 |
23 |
index 000000000..f8a0259e5 |
24 |
--- /dev/null |
25 |
+++ b/bin/install-qa-check.d/90bad-bin-group-write |
26 |
@@ -0,0 +1,40 @@ |
27 |
+# Copyright 1999-2018 Gentoo Foundation |
28 |
+# Distributed under the terms of the GNU General Public License v2 |
29 |
+ |
30 |
+bad_bin_group_write_check() { |
31 |
+ # Warn about globally-installed executables (in /bin, /usr/bin, /sbin, |
32 |
+ # or /usr/sbin) that are group-writable by a nonzero GID. |
33 |
+ |
34 |
+ # This check doesn't work on non-root prefix installations at |
35 |
+ # the moment, because every executable therein is owned by a |
36 |
+ # nonzero GID. |
37 |
+ [[ "${EUID}" -ne "0" || "${PORTAGE_INST_UID}" -ne "0" ]] && return |
38 |
+ |
39 |
+ local d f found=() |
40 |
+ |
41 |
+ for d in "${ED%/}/bin" "${ED%/}/usr/bin" "${ED%/}/sbin" "${ED%/}/usr/sbin"; do |
42 |
+ test -d "${d}" || continue |
43 |
+ |
44 |
+ # Read the results of the "find" command into the "found" bash |
45 |
+ # array. Use -L to catch symlinks whose targets are vulnerable, |
46 |
+ # even though it won't catch ABSOLUTE symlinks until the package |
47 |
+ # is RE-installed (the first time around, the target won't exist). |
48 |
+ # We match the GID and not the name "root" here because (for |
49 |
+ # example) on FreeBSD, the superuser group is "wheel". |
50 |
+ while read -r -d '' f; do |
51 |
+ found+=( "${f}" ) |
52 |
+ done < <(find -L "${d}" -maxdepth 1 -type f -perm /g+w ! -gid 0 -print0) |
53 |
+ |
54 |
+ if [[ ${found[@]} ]]; then |
55 |
+ eqawarn "system executables group-writable by nonzero gid:" |
56 |
+ for f in "${found[@]}"; do |
57 |
+ # Strip off the leading destdir before outputting the path, |
58 |
+ # but leave the prefix if there is one. |
59 |
+ eqawarn " ${f#${D%/}/}" |
60 |
+ done |
61 |
+ fi |
62 |
+ done |
63 |
+} |
64 |
+ |
65 |
+bad_bin_group_write_check |
66 |
+: |
67 |
-- |
68 |
2.16.4 |