90bad-bin-group-write

90bad-bin-group-write (text/plain), 1.22 KB, created by Michael Orlitzky on 2017-09-06 20:15:21 UTC

# Copyright 1999-2017 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2

bad_bin_group_write_check() {
	# Warn about globally-installed executables (in /bin, /usr/bin, /sbin,
	# or /usr/sbin) that are group-writable by a nonzero GID.

	# This check doesn't work on non-root prefix installations at
	# the moment, because every executable therein is owned by a
	# nonzero GID.
	[[ "${EUID}" -eq "0" ]] || return

	local d f found=()

	for d in "${ED}/bin" "${ED}/usr/bin" "${ED}/sbin" "${ED}/usr/sbin"; do
		test -d "${d}" || continue

		# Read the results of the "find" command into the "found" bash
		# array. Use -L to catch symlinks whose targets are vulnerable.
		# We match the GID and not the name "root" here because (for
		# example) on FreeBSD, the superuser group is "wheel".
		while read -r -d '' f; do
			found+=( "${f}" )
		done < <(find -L "${d}" -maxdepth 1 -type f -perm /g+w ! -gid 0 -print0)

		if [[ ${found[@]} ]]; then
			eqawarn "system executables group-writable by nonzero gid:"
			for f in "${found[@]}"; do
				# Strip off the leading ${D} before outputting the path,
				# but leave the prefix if there is one.
				eqawarn "  ${f#${D}}"
			done
		fi
	done
}

bad_bin_group_write_check
: