0

Some packages install software which needs to run with root privileges, such as the sudo package. Others, such as vim, do not inherently need to run with root privileges.

Is there a generic way to tell, by looking at either a specfile, config file, or other file in the sources of an SRPM, whether or not a package will install software that will be run with root privileges or is setuid, without actually installing the binary rpm package on the system first?

Improve this question
1
  • You can list the permissions of files in a binary package with rpm -qp --dump foo.rpm. You can find setuid this way, but "requires root" is nothing something that is flagged in any way
    – jordanm
    Jul 31, 2020 at 19:42

1 Answer 1

Reset to default
0

There is no way to find the files in SRC.RPM. Because the scripts in %build and %install section and tags in %files section can do zilions things hard to detect. The only way is to build the binary package and then:

rpmdev-extract $PACKAGE.rpm
cd $PACKAGE
find . -perm /4000
find . -perm /2000

The first find finds SUID files, the second SGID files.

To be hyper correct, you should check the output of rpm -qp --scripts $PACKAGE.rpm because evil packager can hide chmod there too.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .