From 3134ae11270dae9d8dddc5a16e2321b675b5d522 Mon Sep 17 00:00:00 2001 From: Richard Purdie Date: Wed, 23 Jul 2014 17:05:44 +0100 Subject: sanity: Check for setgid/setuid TMPDIR Building in a TMPDIR which has setgid or setuid is a bad idea. We could try and reset the permissions but since these can also invade into other directories like the cache or sstate, lets tell the user to fix it instead. [YOCTO #6519] (From OE-Core rev: 8e44fc36018fda9b1f9ca8aebde3e744afc07eaa) Signed-off-by: Richard Purdie --- meta/classes/sanity.bbclass | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'meta/classes/sanity.bbclass') diff --git a/meta/classes/sanity.bbclass b/meta/classes/sanity.bbclass index ed65814be2..1ad663a057 100644 --- a/meta/classes/sanity.bbclass +++ b/meta/classes/sanity.bbclass @@ -514,6 +514,7 @@ def check_sanity_version_change(status, d): import xml.parsers.expat except ImportError: status.addresult('Your python is not a full install. Please install the module xml.parsers.expat (python-xml on openSUSE and SUSE Linux).\n') + import stat status.addresult(check_make_version(d)) status.addresult(check_tar_version(d)) @@ -566,6 +567,11 @@ def check_sanity_version_change(status, d): # Check that TMPDIR isn't on a filesystem with limited filename length (eg. eCryptFS) tmpdir = d.getVar('TMPDIR', True) status.addresult(check_create_long_filename(tmpdir, "TMPDIR")) + tmpdirmode = os.stat(tmpdir).st_mode + if (tmpdirmode & stat.S_ISGID): + status.addresult("TMPDIR is setgid, please don't build in a setgid directory") + if (tmpdirmode & stat.S_ISUID): + status.addresult("TMPDIR is setuid, please don't build in a setuid directory") # Some third-party software apparently relies on chmod etc. being suid root (!!) import stat -- cgit v1.2.3-54-g00ecf