[gentoo-commits] proj/portage:master commit in: bin/install-qa-check.d/

["Zac Medico" <zmedico@gentoo.org>]

commit:     04e71a831bc42f2a0de1694dd2013eac0414e007
Author:     Michael Orlitzky <mjo <AT> gentoo <DOT> org>
AuthorDate: Tue Aug  7 16:46:03 2018 +0000
Commit:     Zac Medico <zmedico <AT> gentoo <DOT> org>
CommitDate: Tue Aug  7 18:39:26 2018 +0000
URL:        https://gitweb.gentoo.org/proj/portage.git/commit/?id=04e71a83

bin/install-qa-check.d: add new 90bad-bin-owner QA check.

System executables that are not owned by root pose a security
risk. The owner of the executable is free to modify it at any time;
so, for example, he can change a daemon's behavior to make it
malicious before the next time the service is started (usually by
root).

On a "normal" system, the superuser should own every system executable
(even setuid ones, for security reasons). This commit adds a new
install-time check that reports any such binaries with a QA
warning. To avoid false positives, non-"normal" systems (like prefix)
are skipped at the moment.

Bug: https://bugs.gentoo.org/629398

 bin/install-qa-check.d/90bad-bin-owner | 48 ++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/bin/install-qa-check.d/90bad-bin-owner b/bin/install-qa-check.d/90bad-bin-owner
new file mode 100644
index 000000000..c3ee30746
--- /dev/null
+++ b/bin/install-qa-check.d/90bad-bin-owner
@@ -0,0 +1,48 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+bad_bin_owner_check() {
+	# Warn about globally-installed executables (in /bin, /usr/bin, /sbin,
+	# /usr/sbin, or /opt/bin) that are owned by a nonzero UID.
+
+	# This check doesn't work on non-root prefix installations at
+	# the moment, because every executable therein is owned by a
+	# nonzero UID.
+	[[ "${EUID}" -ne "0" || "${PORTAGE_INST_UID}" -ne "0" ]] && return
+
+	local d f found=()
+
+	for d in "${ED%/}/opt/bin" "${ED%/}/bin"  "${ED%/}/usr/bin" \
+							   "${ED%/}/sbin" "${ED%/}/usr/sbin"; do
+		[[ -d "${d}" ]] || continue
+
+		# Read the results of the "find" command into the "found" bash array.
+		#
+		# Use -L to catch symlinks whose targets are owned by a non-root user,
+		# even though it won't catch ABSOLUTE symlinks until the package
+		# is RE-installed (the first time around, the target won't exist).
+		#
+		# We do want to list non-superuser setuid executables, because
+		# they can be exploited. The owner can simply wipe the setuid
+		# bit, and then alter the contents of the file. The superuser
+		# will then have a time bomb in his $PATH.
+		while read -r -d '' f; do
+			found+=( "${f}" )
+		done < <(find -L "${d}"   \
+					-maxdepth 1   \
+					-type f       \
+					! -uid 0      \
+					-print0)
+	done
+
+	if [[ ${found[@]} ]]; then
+		eqawarn "system executables owned by nonzero uid:"
+		for f in "${found[@]}"; do
+			# Strip off the leading destdir before outputting the path.
+			eqawarn "  ${f#${D%/}}"
+		done
+	fi
+}
+
+bad_bin_owner_check
+: