PATCH: Debian-specific compaudit security

PATCH: Debian-specific compaudit security

[Clint Adams]

Debian policy requires that /usr/local/share/zsh/site-functions (or
equivalent) be root:staff mode 2775.

compaudit will complain if this is the case and the aforementioned
directory is in $fpath, so this patch special-cases /usr/local
directories when /etc/debian_version is present.

This will still cause problems when non-root-owned files are
added, but I'm less comfortable ignoring those.

I imagine this should be more generic in at least one way.

Index: Completion/compaudit
===================================================================
RCS file: /cvsroot/zsh/zsh/Completion/compaudit,v
retrieving revision 1.4
diff -u -r1.4 compaudit
--- Completion/compaudit	2001/09/06 20:17:14	1.4
+++ Completion/compaudit	2001/09/06 20:42:03
@@ -82,7 +82,7 @@
 # by NFS group sharing with an untrustworthy machine).  So we must assume
 # that this has not happened, and pick the best group.
 
-local GROUP GROUPMEM _i_pw _i_gid
+local GROUP GROUPMEM _i_pw _i_gid _i_ulwdirs
 while IFS=: read GROUP _i_pw _i_gid GROUPMEM; do
   if (( UID == EUID )); then
     [[ $GROUP == $LOGNAME ]] && break
@@ -108,6 +108,13 @@
   _i_wdirs=( ${^fpath}(Nf:g+w:,f:o+w:,^u0u${EUID})
              ${^fpath}/..(Nf:g+w:,f:o+w:,^u0u${EUID}) )
 fi
+
+if [[ -f /etc/debian_version ]]
+then
+_i_ulwdirs=( ${(M)_i_wdirs:#/usr/local/*} )
+_i_wdirs=( ${_i_wdirs:#/usr/local/*} ${^_i_ulwdir}(Nf:g+ws:^g:staff:,f:o+w:,^u0) )
+fi
+
 _i_wdirs=( $_i_wdirs ${^fpath}.zwc^([^_]*|*~)(N^u0u${EUID}) )
 _i_wfiles=( ${^fpath}/^([^_]*|*~)(N^u0u${EUID}) )
 

Re: PATCH: Debian-specific compaudit security

[Bart Schaefer]

On Sep 6,  4:49pm, Clint Adams wrote:
>
> Debian policy requires that /usr/local/share/zsh/site-functions (or
> equivalent) be root:staff mode 2775.

What we need is for compaudit to look for a list of "safe" groups and/or
owners, defaulting to no groups, the current user, and root.

We could use a style for this, which could then be set in the /etc/z*
files as appropriate.