Bug 278404 - ports-mgmt/portlint: Add check for files' permissions
Summary: ports-mgmt/portlint: Add check for files' permissions
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Joe Marcus Clarke
URL:
Keywords: security
Depends on:
Blocks:
 
Reported: 2024-04-17 07:24 UTC by Älven
Modified: 2024-09-30 12:44 UTC (History)
0 users

See Also:
bugzilla: maintainer-feedback? (marcus)


Attachments
List of files in ports with exec flag set (30.70 KB, text/plain)
2024-04-17 18:34 UTC, Älven
no flags Details
List of files in ports with exec flag set (4.76 KB, text/plain)
2024-04-18 12:18 UTC, Älven
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Älven 2024-04-17 07:24:02 UTC

    
Comment 1 Älven 2024-04-17 07:28:56 UTC
There should be some check in portlint(1) and possibly, git hook on git.freebsd.org to keep files with wrong permissions from entering the ports tree.
Comment 2 Joe Marcus Clarke freebsd_committer freebsd_triage 2024-04-17 15:24:26 UTC
Say more about this.  If you can provide an example port where this caused problem that will also help in testing.
Comment 3 Älven 2024-04-17 18:34:16 UTC
Created attachment 250035 [details]
List of files in ports with exec flag set

By accident I stumbled in this bug #277872 with comms/quisk having permissions 755 instead of 644 on comms/quisk/pkg-descr.
After quick search (`find . -type f -perm +a=x > exec_flag_set.list`) I had rather long list of files with exec flag set (see attachment).
Not sure, whether it can cause any problems, just felt it's not the right thing and may be easily prevented and so avoid any possible problems in the future.
Comment 4 Älven 2024-04-18 12:18:16 UTC
Created attachment 250046 [details]
List of files in ports with exec flag set
Comment 5 Joe Marcus Clarke freebsd_committer freebsd_triage 2024-09-23 14:20:59 UTC
Thanks!  I've added a WARN check in my git repo.  I don't see why a file _would_ need to be executable, but let's do WARN for now.  This will be added to the next portlint release.
Comment 6 commit-hook freebsd_committer freebsd_triage 2024-09-30 12:43:54 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=0a0c3ea9f5be43f4a16b3a02d5b77d3d98525895

commit 0a0c3ea9f5be43f4a16b3a02d5b77d3d98525895
Author:     Joe Marcus Clarke <marcus@FreeBSD.org>
AuthorDate: 2024-09-30 12:39:28 +0000
Commit:     Joe Marcus Clarke <marcus@FreeBSD.org>
CommitDate: 2024-09-30 12:42:42 +0000

    ports-mgmt/portlint: Update to 2.22.2

    * Check for executable files [1]
    * Check that shared objects were installed in ${PREFIX}/lib [2]
    * Allow MASTERDIR to contain :H[:H] [3]

    PR:             278404 [1]
                    278773 [2]
    Submitted by:   Piotr Smyrak <piotr@smyrak.com> [3]

 ports-mgmt/portlint/Makefile        |  2 +-
 ports-mgmt/portlint/src/portlint.pl | 18 ++++++++++++++----
 2 files changed, 15 insertions(+), 5 deletions(-)
Comment 7 Joe Marcus Clarke freebsd_committer freebsd_triage 2024-09-30 12:44:07 UTC
Fixed in 2.22.2