Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SUIDPermissionsCheck: chkstat to permctl rename #1294

Merged
merged 1 commit into from
Nov 6, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion rpmlint/checks/SUIDPermissionsCheck.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
import os
import re
import stat

import rpm
Expand Down Expand Up @@ -59,7 +60,7 @@ def _check_post_scriptlets(self, pkg, path, need_verifyscript):

if script:
for line in script.split('\n'):
if 'chkstat -n' in line and path in line:
if re.search(fr'(chkstat|permctl) -n .* {path}', line):
found = True
break

Expand Down
43 changes: 43 additions & 0 deletions test/test_suid_permissions.py
Original file line number Diff line number Diff line change
@@ -1,10 +1,12 @@
import os
import stat

import pytest
from rpmlint.checks.SUIDPermissionsCheck import SUIDPermissionsCheck
from rpmlint.filter import Filter

import Testing
from Testing import get_tested_mock_package
from Testing import get_tested_package, get_tested_path


Expand Down Expand Up @@ -132,3 +134,44 @@ def test_permissions_d(tmp_path, package, permissions_check):
test.check(get_tested_package(package, tmp_path))
out = output.print_results(output.results)
assert 'sendmail.x86_64: E: permissions-file-setuid-bit /usr/sbin/sendmail is packaged with setuid/setgid bits (02555)' not in out


# https://github.com/rpm-software-management/rpmlint/issues/1292
PERMCTL_PKG = get_tested_mock_package(
lazyload=True,
name='permctl',
files={
'/var/lib/perms/test': {
'is_dir': True,
'metadata': {
'mode': 0o640 | stat.S_IFDIR | stat.S_ISUID,
'user': 'root',
'group': 'root',
},
},
},
header={
'POSTIN': """
if [ -x /usr/bin/permctl ]; then \
/usr/bin/permctl -n --set --system /var/lib/perms/test || : \
fi \
""",
},
)
CHKSTAT_PKG = PERMCTL_PKG.clone(
header={
'POSTIN': """
if [ -x /usr/bin/chkstat ]; then \
/usr/bin/chkstat -n --set --system /var/lib/perms/test || : \
fi \
""",
},
)


@pytest.mark.parametrize('package', [PERMCTL_PKG, CHKSTAT_PKG])
def test_permissions_permctl(package, permissions_check):
output, test = permissions_check
test.check(package)
out = output.print_results(output.results)
assert 'permissions-missing-postin' not in out
Loading