Skip to contentSkip to conversation

sanity: Check for setgid/setuid TMPDIR

PATCH In review Richard Purdie 2 participants 2 messages Jul 23, 2014

lore
Share & tools
lore

Richard Purdie

author
#0 lore raw

PATCH 1/1 sanity: Check for setgid/setuid TMPDIR

Building in a TMPDIR which has setgid or setuid is a bad idea. We could try and reset the permissions but since these can also invade into other directories like the cache or sstate, lets tell the user to fix it instead.

[YOCTO #6519]

Signed-off-by Richard Purdie <[email protected]>
meta/classes/sanity.bbclass +6 -0
index ed65814..367b68e 100644
@@ -514,6 +514,7 @@ def check_sanity_version_change(status, d):
         import xml.parsers.expat
     except ImportError:
         status.addresult('Your python is not a full install. Please install the module xml.parsers.expat (python-xml on openSUSE and SUSE Linux).\n')
+    import stat
 
     status.addresult(check_make_version(d))
     status.addresult(check_tar_version(d))

@@ -566,6 +567,11 @@ def check_sanity_version_change(status, d):
     # Check that TMPDIR isn't on a filesystem with limited filename length (eg. eCryptFS)
     tmpdir = d.getVar('TMPDIR', True)
     status.addresult(check_create_long_filename(tmpdir, "TMPDIR"))
+    tmpdirmode = os.stat(tmpdir).st_mode
+    if (tmpdirmode & stat.S_ISGID):
+        status.addresult("TMPDIR is setgid, please don't build in a setgid directory")
+    if (tmpdirmode & stat.S_ISUID):
+        status.addresult("TMPDIR is setuid, please don't build in a setgid directory")
 
     # Some third-party software apparently relies on chmod etc. being suid root (!!)
     import stat
#1 lore raw
Quoted 2 lines · Richard Purdie

+ status.addresult("TMPDIR is setuid, please don't build in a
setgid directory")

Minor typo, s/setgid directory/setuid directory/.

Signature · 5 lines
Christopher Larson
clarson at kergoth dot com
Founder - BitBake, OpenEmbedded, OpenZaurus
Maintainer - Tslib
Senior Software Engineer, Mentor Graphics