tree 767c4d62de978c9ba037223be2a26ebb243d2c86
parent 04e71a831bc42f2a0de1694dd2013eac0414e007
author Michael Orlitzky <mjo@gentoo.org> 1533660364 -0400
committer Zac Medico <zmedico@gentoo.org> 1533667166 -0700
gpgsig -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQKTBAABCgB9FiEE8OgXaltWzqgSupCu0HX7jBBKPSAFAltp515fFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEYw
 RTgxNzZBNUI1NkNFQTgxMkJBOTBBRUQwNzVGQjhDMTA0QTNEMjAACgkQ0HX7jBBK
 PSDRpQ//YsX6geiDZWceFHp5jzb2b63Zp+IU9b+diOINHLS3wWHlAkNb+ymuNPKk
 L/BA0icyOBQLx7TFiwkWKLeN6ZW4xYw6EG3ehfcxc8YOCANTxnoF4JdLJrZrJUQE
 OmJtAAi1V392GeAT65SdU1/jzu4oUfVNSA2rtrzsoOULC2NaysrlhOMUir7DLToy
 Tr8WZ/5JCkGdIKTBLW17VvyON6EVWoNLThguqR1CdIwbVXfDeN4u4ZRp8749aAaR
 L1U35LlU+6/uzRPZZ7zZsL+sdmr6H3UnJ5vSbHQHnA/+KsyHhLaH2MYmkdYjZkok
 5UaDWqMdm1hCvOJLa1rZtdZulSYqQp+2FFi6PZ6Y8X4zM3k4Dsvxb0YfmdmfOLAi
 OCL7oSMfxiFeJeunti3vA7UkU3XuKKIlih2IkBi7VT0tz2SNRoBWu+pBNoTyYDQn
 U3KLUqf+VZoOr/+ELuBMs5lJpKYTdZtlGYDNCAmkRRXq1CLklehlioA2zr5+DxKS
 TNGcvwaKQyY8bIjH/pR7Uk0wE4qdapNo5s+ukrL8uVPmo9AZ8F0zIB41oRB1YpnP
 wiTGRLLcUYdHTMHy63/eEKPd7j+zRW+uXmR4iVydoZuVNhbwGtbYIXsxVhJnjJGH
 6ak12dvNOUhukI4ii+ChFI3x+vL4M1bAxVuAybFH26uDHk9iJ24=
 =Wquj
 -----END PGP SIGNATURE-----

bin/install-qa-check.d: add new 90bad-bin-group-write QA check.

System executables that are writable by a non-root user pose a
security risk. Anyone who can write to an executable can change its
behavior. If that executable is later run with elevated privileges
(say, by root, when the machine starts), then the non-root user can
escalate his own privileges to those of the person running the
modified executable.

The 90bad-bin-owner check already addresses one cause for a non-root
user to be able to modify an executable: because he owns it. This
commit adds another check, to ensure that no non-root *groups* have
write access to any system executables. On a "normal" system, all
system executables should be writable only by the super-user's group,
if any. To avoid false-positives, non-"normal" systems (like prefix)
are skipped.

Closes: https://bugs.gentoo.org/629398