Some packages install software which needs to run with root privileges, such as the sudo package. Others, such as vim, do not inherently need to run with root privileges.

Is there a generic way to tell, by looking at either a specfile, config file, or other file in the sources of an SRPM, whether or not a package will install software that will be run with root privileges or is setuid, without actually installing the binary rpm package on the system first?

  • You can list the permissions of files in a binary package with rpm -qp --dump foo.rpm. You can find setuid this way, but "requires root" is nothing something that is flagged in any way – jordanm Jul 31 '20 at 19:42

There is no way to find the files in SRC.RPM. Because the scripts in %build and %install section and tags in %files section can do zilions things hard to detect. The only way is to build the binary package and then:

rpmdev-extract $PACKAGE.rpm
find . -perm /4000
find . -perm /2000

The first find finds SUID files, the second SGID files.

To be hyper correct, you should check the output of rpm -qp --scripts $PACKAGE.rpm because evil packager can hide chmod there too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.