1 |
System executables that are not owned by root pose a security |
2 |
risk. The owner of the executable is free to modify it at any time; |
3 |
so, for example, he can change a daemon's behavior to make it |
4 |
malicious before the next time the service is started (usually by |
5 |
root). |
6 |
|
7 |
On a "normal" system, the superuser should own every system executable |
8 |
(even setuid ones, for security reasons). This commit adds a new |
9 |
install-time check that reports any such binaries with a QA |
10 |
warning. To avoid false positives, non-"normal" systems (like prefix) |
11 |
are skipped at the moment. |
12 |
|
13 |
Bug: https://bugs.gentoo.org/629398 |
14 |
--- |
15 |
bin/install-qa-check.d/90bad-bin-owner | 48 ++++++++++++++++++++++++++++++++++ |
16 |
1 file changed, 48 insertions(+) |
17 |
create mode 100644 bin/install-qa-check.d/90bad-bin-owner |
18 |
|
19 |
diff --git a/bin/install-qa-check.d/90bad-bin-owner b/bin/install-qa-check.d/90bad-bin-owner |
20 |
new file mode 100644 |
21 |
index 000000000..c3ee30746 |
22 |
--- /dev/null |
23 |
+++ b/bin/install-qa-check.d/90bad-bin-owner |
24 |
@@ -0,0 +1,48 @@ |
25 |
+# Copyright 1999-2018 Gentoo Foundation |
26 |
+# Distributed under the terms of the GNU General Public License v2 |
27 |
+ |
28 |
+bad_bin_owner_check() { |
29 |
+ # Warn about globally-installed executables (in /bin, /usr/bin, /sbin, |
30 |
+ # /usr/sbin, or /opt/bin) that are owned by a nonzero UID. |
31 |
+ |
32 |
+ # This check doesn't work on non-root prefix installations at |
33 |
+ # the moment, because every executable therein is owned by a |
34 |
+ # nonzero UID. |
35 |
+ [[ "${EUID}" -ne "0" || "${PORTAGE_INST_UID}" -ne "0" ]] && return |
36 |
+ |
37 |
+ local d f found=() |
38 |
+ |
39 |
+ for d in "${ED%/}/opt/bin" "${ED%/}/bin" "${ED%/}/usr/bin" \ |
40 |
+ "${ED%/}/sbin" "${ED%/}/usr/sbin"; do |
41 |
+ [[ -d "${d}" ]] || continue |
42 |
+ |
43 |
+ # Read the results of the "find" command into the "found" bash array. |
44 |
+ # |
45 |
+ # Use -L to catch symlinks whose targets are owned by a non-root user, |
46 |
+ # even though it won't catch ABSOLUTE symlinks until the package |
47 |
+ # is RE-installed (the first time around, the target won't exist). |
48 |
+ # |
49 |
+ # We do want to list non-superuser setuid executables, because |
50 |
+ # they can be exploited. The owner can simply wipe the setuid |
51 |
+ # bit, and then alter the contents of the file. The superuser |
52 |
+ # will then have a time bomb in his $PATH. |
53 |
+ while read -r -d '' f; do |
54 |
+ found+=( "${f}" ) |
55 |
+ done < <(find -L "${d}" \ |
56 |
+ -maxdepth 1 \ |
57 |
+ -type f \ |
58 |
+ ! -uid 0 \ |
59 |
+ -print0) |
60 |
+ done |
61 |
+ |
62 |
+ if [[ ${found[@]} ]]; then |
63 |
+ eqawarn "system executables owned by nonzero uid:" |
64 |
+ for f in "${found[@]}"; do |
65 |
+ # Strip off the leading destdir before outputting the path. |
66 |
+ eqawarn " ${f#${D%/}}" |
67 |
+ done |
68 |
+ fi |
69 |
+} |
70 |
+ |
71 |
+bad_bin_owner_check |
72 |
+: |
73 |
-- |
74 |
2.16.4 |