Description of problem: I have proposed a feature for F15 to remove all setuid apps and replace them with file capabilities. As part of this effort, I would like to get rpmlint to report a warning on setuid and recommend they use file capabilities. https://fedoraproject.org/wiki/Features/RemoveSETUID
rpmlint already reports errors about setuid binaries, for example: $ rpmlint util-linux-ng | grep setuid-binary util-linux-ng.x86_64: E: setuid-binary /usr/bin/chsh root 04711L util-linux-ng.x86_64: E: setuid-binary /bin/mount root 04755L util-linux-ng.x86_64: E: setuid-binary /usr/bin/chfn root 04711L util-linux-ng.x86_64: E: setuid-binary /bin/umount root 04755L I just added a note about file capabilities to the info message upstream: http://rpmlint.zarb.org/cgi-bin/trac.cgi/changeset/1810 Previously there was a thought that we'd start collecting a "whitelist" of allowed setuid binaries (see bug 496737) but I suppose this Feature will make that point moot. There's only one setuid executable (/usr/kerberos/bin/ksu) whitelisted in the current Fedora rpmlint package; that whitelisting should be removed.
No I think we are going to have to allow a few, su, sudo, consolehelper, ksu.
Ok, I'll add su and sudo (and sudoedit) to the whitelist instead. Don't know about consolehelper, FWIW /usr/bin/consolehelper is not setuid here (F-13). $ ls -l /usr/bin/consolehelper* -rwxr-xr-x 1 root root 9048 Mar 26 2010 /usr/bin/consolehelper -rwxr-xr-x 1 root root 42072 Mar 26 2010 /usr/bin/consolehelper-gtk
-rws--x--x. 1 root root 43856 Sep 29 19:18 /usr/sbin/userhelper Some of the other requests are being rejected also. passwd, and initctl?
(In reply to comment #4) > -rws--x--x. 1 root root 43856 Sep 29 19:18 /usr/sbin/userhelper Ah, userhelper, not consolehelper. > Some of the other requests are being rejected also. passwd, and initctl? Not sure what you mean by that - if you're asking me whether those should be whitelisted or not, I'm sure you're more qualified to tell it than I am. Anyway this is what I currently have in store for the next rpmlint package's default config, you can try it out by inserting it into your ~/.config/rpmlint: # https://bugzilla.redhat.com/496737, https://bugzilla.redhat.com/646455 for pkg, exe in (("coreutils", "/bin/su"), ("krb5-workstation", "/usr/kerberos/bin/ksu"), ("passwd", "/usr/bin/passwd"), ("sudo", "/usr/sbin/sudo(edit)?"), ("upstart", "/sbin/initctl"), ("usermode", "/usr/sbin/userhelper")): addFilter("%s.* (setuid-binary|non-standard-executable-perm) %s (root )?04" % (pkg, exe))
(In reply to comment #5) > ("sudo", "/usr/sbin/sudo(edit)?"), This should be /usr/bin, not /usr/sbin.
rpmlint-1.0-1.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/rpmlint-1.0-1.fc14
rpmlint-1.0-1.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update rpmlint'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/rpmlint-1.0-1.fc14
rpmlint-1.0-1.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.