- 

# Copyright 1999-2018 Gentoo Foundation

# Distributed under the terms of the GNU General Public License v2

bad_bin_group_write_check() {

	# Warn about globally-installed executables (in /bin, /usr/bin, /sbin,

	# or /usr/sbin) that are group-writable by a nonzero GID.

	# This check doesn't work on non-root prefix installations at

	# the moment, because every executable therein is owned by a

	# nonzero GID.

	[[ "${EUID}" -ne "0" || "${PORTAGE_INST_UID}" -ne "0" ]] && return

	local d f found=()

	for d in "${ED%/}/bin" "${ED%/}/usr/bin" "${ED%/}/sbin" "${ED%/}/usr/sbin"; do

		test -d "${d}" || continue

		# Read the results of the "find" command into the "found" bash

		# array. Use -L to catch symlinks whose targets are vulnerable,

		# even though it won't catch ABSOLUTE symlinks until the package

		# is RE-installed (the first time around, the target won't exist).

		# We match the GID and not the name "root" here because (for

		# example) on FreeBSD, the superuser group is "wheel".

		while read -r -d '' f; do

			found+=( "${f}" )

		done < <(find -L "${d}" -maxdepth 1 -type f -perm /g+w ! -gid 0 -print0)

		if [[ ${found[@]} ]]; then

			eqawarn "system executables group-writable by nonzero gid:"

			for f in "${found[@]}"; do

				# Strip off the leading destdir before outputting the path,

				# but leave the prefix if there is one.

				eqawarn "  ${f#${D%/}/}"

			done

		fi

	done

}

bad_bin_group_write_check

: