W dniu nie, 29.07.2018 o godzinie 13∶37 -0400, użytkownik Michael Orlitzky napisał: > System executables that are not owned by root pose a security > risk. The owner of the executable is free to modify it at any time; > so, for example, he can change a daemon's behavior to make it > malicious before the next time the service is started (usually by > root). > > On a "normal" system, there is no good reason why the superuser should > not own every system executable. This commit adds a new install-time > check that reports any such binaries with a QA warning. To avoid false > positives, non-"normal" systems (like prefix) are skipped at the moment. > > Bug: https://bugs.gentoo.org/629398 > --- > bin/install-qa-check.d/90bad-bin-owner | 38 > ++++++++++++++++++++++++++++++++++ > 1 file changed, 38 insertions(+) > create mode 100644 bin/install-qa-check.d/90bad-bin-owner > > diff --git a/bin/install-qa-check.d/90bad-bin-owner > b/bin/install-qa-check.d/90bad-bin-owner > new file mode 100644 > index 000000000..188d67a51 > --- /dev/null > +++ b/bin/install-qa-check.d/90bad-bin-owner > @@ -0,0 +1,38 @@ > +# Copyright 1999-2018 Gentoo Foundation > +# Distributed under the terms of the GNU General Public License v2 > + > +bad_bin_owner_check() { > + # Warn about globally-installed executables (in /bin, /usr/bin, /sbin, > + # or /usr/sbin) that are owned by a nonzero UID. > + > + # This check doesn't work on non-root prefix installations at > + # the moment, because every executable therein is owned by a > + # nonzero UID. > + [[ "${EUID}" -ne "0" || "${PORTAGE_INST_UID}" -ne "0" ]] && return > + > + local d f found=() > + > + for d in "${ED%/}/bin" "${ED%/}/usr/bin" "${ED%/}/sbin" > "${ED%/}/usr/sbin"; do
I think you should include /opt/bin as well. Or maybe simply all
locations on ${PATH}.
> + [[ -d "${d}" ]] || continue
> +
> + # Read the results of the "find" command into the "found" bash
> array.
> + # Use -L to catch symlinks whose targets are owned by a
> non-root user,
> + # even though it won't catch ABSOLUTE symlinks until the package
> + # is RE-installed (the first time around, the target won't
> exist).
> + while read -r -d '' f; do
> + found+=( "${f}" )
> + done < <(find -L "${d}" -maxdepth 1 -type f ! -uid 0 -print0)
> +
> + if [[ ${found[@]} ]]; then
> + eqawarn "system executables owned by nonzero uid:"
> + for f in "${found[@]}"; do
> + # Strip off the leading destdir before
> outputting the path,
> + # but leave the prefix if there is one.
> + eqawarn " ${f#${D%/}/}"
> + done
> + fi
> + done
> +}
> +
> +bad_bin_owner_check
> +:
--
Best regards,
Michał Górny
signature.asc
Description: This is a digitally signed message part
