This file is indexed.

/usr/lib/tiger/scripts/check_perms is in tiger 1:3.2.3-8.

This file is owned by root:root, with mode 0o755.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
#!/bin/sh
#
#     tiger - A UN*X security checking system
#     Copyright (C) 1993 Douglas Lee Schales, David K. Hess, David R. Safford
#
#    This program is free software; you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation; either version 2, or (at your option)
#    any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#     Please see the file `COPYING' for the complete copyright notice.
#
# check_perms - 06/14/93
#
# 05/07/2009 jfs Fixed use of quotes in check_perms (Savannah bug #26479)
# 08/14/2003 jfs Added OUTPUTMETHOD to dependancies
# 05/01/2003 jfs Fixed dependancies
# 11/05/2002 jfs Small fix to prevent shell expansion to ocur while testing
#                filenames (discovered due a broken self-made package that
#                created a /usr/bin/*config directory, ouch.)
# ??/??/1999 ARC  Changed echo to message and limited giving warnings if owner
#               of files is 'bin'
# 04/28/1993 dls  Added '-L' option to 'ls' so we get permissions from
#               file instead of symbolic link.
#
#-----------------------------------------------------------------------------
#
TigerInstallDir="/usr/lib/tiger"

#
# Set default base directory.
# Order or preference:
#      -B option
#      TIGERHOMEDIR environment variable
#      TigerInstallDir installed location
#
basedir=${TIGERHOMEDIR:=$TigerInstallDir}

for parm
do
   case $parm in
   -B) basedir=$2; break;;
   esac
done

#
# Verify that a config file exists there, and if it does
# source it.
#
[ ! -r $basedir/config ] && {
  echo "--ERROR-- [init002e] No 'config' file in \`$basedir'."
  exit 1
}

. $basedir/config

. $BASEDIR/initdefs
#
# If run in test mode (-t) this will verify that all required
# elements are set.
#
[ "$Tiger_TESTMODE" = 'Y' ] && {
  haveallcmds AWK GET_MOUNTS GREP LS SGREP OUTPUTMETHOD || exit 1
  haveallfiles FILE_ACL BASEDIR WORKDIR || exit 1
  haveallvars TESTLINK || exit 1
  
  echo "--CONFIG-- [init003c] $0: Configuration ok..."
  exit 0
}

#------------------------------------------------------------------------

echo
echo "# Performing check of system file permissions..."

haveallcmds AWK GET_MOUNTS GREP LS SGREP OUTPUTMETHOD || exit 1
haveallfiles FILE_ACL WORKDIR BASEDIR ||
haveallvars TESTLINK || exit 1

[ ! -f "$FILE_ACL" ] && {
  message CONFIG perm004c "" "No file permission database."
  exit 1
}

display_what_access()
{
  file=$1
  onoff=$2
  who=$3
  what=$4

  access=$what

  if [ "$access" = 'X' ]; then
    access='execute'
    [ -d "$file" ] && access='search'
  fi

  [ "$onoff" = '0' ] && {
    message $level perm001w "" "$file should not have $who $access."
  }
}
           
check_file()
{
  [ "$suid" != "$rsuid" -a "$rsuid" = '1' ] && {
    message ALERT perm023a "" "$filename is setuid to \`$rowner'."
    changelog "ALERT : chmod : u-s : $filename"
  }
  [ "$sgid" != "$rsgid" -a "$rsgid" = '1' ] && {
    message ALERT perm024a "" "$filename is setgid to \`$rgroup'."
    changelog "ALERT : chmod : g-s : $filename"
  }
  [ "$owner" != '.' -a "$owner" != "$rowner"  -a "$rowner" != "bin" ] && {
    message $level perm$ownmid$m "" "The owner of $filename should be $owner (owned by $rowner)."
    changelog "$level : chown : $owner : $filename"
  }

  [ "$group" != '.' -a "$group" != "$rgroup" ] && {
    message $level perm$grpmid$m "" "The group owner of $filename should be $group."
    changelog "$level : chgrp : $group : $filename"
  }

  [ "$ur" != '.' -a "$ur" != "$rur" ] && {
    display_what_access $filename $ur owner read
    changelog "$level : chmod : u-r : $filename"
  }
  [ "$uw" != '.' -a "$uw" != "$ruw" ] && {
    display_what_access $filename $uw owner write
    changelog "$level : chmod : u-w : $filename"
  }
  [ "$ux" != '.' -a "$ux" != "$rux" ] && {
    display_what_access $filename $ux owner X
    changelog "$level : chmod : u-x : $filename"
  }
    
  [ "$gr" != '.' -a "$gr" != "$rgr" ] && {
    display_what_access $filename $gr group read
    changelog "$level : chmod : g-r : $filename"
  }
  [ "$gw" != '.' -a "$gw" != "$rgw" ] && {
    display_what_access $filename $gw group write
    changelog "$level : chmod : g-w : $filename"
  }
  [ "$gx" != '.' -a "$gx" != "$rgx" ] && {
    display_what_access $filename $gx group X
    changelog "$level : chmod : g-x : $filename"
  }
    
  [ "$or" != '.' -a "$or" != "$ror" ] && {
    display_what_access $filename $or world read
    changelog "$level : chmod : o-r : $filename"
  }
  [ "$ow" != '.' -a "$ow" != "$row" ] && {
    display_what_access $filename $ow world write
    changelog "$level : chmod : o-w : $filename"
  }
  [ "$ox" != '.' -a "$ox" != "$rox" ] && {
    display_what_access $filename $ox world X
    changelog "$level : chmod : o-x : $filename"
  }
}

{
  $GREP -v '^#' $FILE_ACL |
  while read file owner group suid sgid ur uw ux gr gw gx or ow ox lvl ownmid grpmid prmmid
  do
    if [ "$lvl" = 'A' ]; then
      level='ALERT'
      m='a'
    elif [ "$lvl" = 'F' ]; then
      level='FAIL'
      m='f'
    else
      level='WARN'
      m='w'
    fi
    
    getpermit $file |
    while read filename rowner rgroup rur ruw rux rgr rgw rgx ror row rox rsuid rsgid rstk
    do
      [ ! $TESTLINK "$filename" ] && [ -f "$filename" -o -d "$filename" ] &&
      if [ "$file" = "$filename" ]; then
	check_file "$filename"
      else
	$SGREP "^$filename[ 	]" $FILE_ACL 2>/dev/null || 
	check_file "$filename" 
      fi
    done
  done

  saveifs=$IFS

  haveallcmds GET_MOUNTS && {  
    $GET_MOUNTS local all |
    while read mtpoint fstype fsdevice rdevice
    do
      for fsdev in $fsdevice $rdevice
      do
	[ -n "$fsdev" -a \( -b $fsdev -o -c $fsdev \) ] && {
	  getpermit $fsdev |
	  {
	    read _f owner group ur uw ux gr gw gx or ow ox suid sgid stk

	    [ "$owner" != 'root' ] && {
	      message WARN perm022w "" "Disk device $fsdev not owned by root (owned by $owner)."
	      changelog "WARN : chown : root : $fsdev "
	    }
	
	    [ "$or$ow" != '00' ] && {
	      perm=
	      [ "$or" = '1' ] && {
		perm='read'
		change='o-r'
	      }
	      [ "$ow" = '1' ] && {
		perm='write'
		change='o-w'
	      }
	      [ "$or$ow" = '11' ] && {
		perm='read/write'
		change='o-rw'
	      }
	      message WARN perm020w "" "Disk device $fsdev has world $perm access."
	      changelog "WARN : chmod : $change : $fsdev"
	    }
#TODO: In Debian GNU/Linux disk group is created to access /dev/hd*
	    [ "$gr$gw" != '00' ] && 
#NOTE: In HP-UX you could add also (contributed by Bob Hall
# [ "$group" != 'sys' ] && 
	    [ "$group" != "disk" ] && {
	      perm=
	      [ "$gr" = '1' ] && {
		perm='read'
		change='g-r'
	      }
	      [ "$gw" = '1' ] && {
		perm='write'
		change='g-w'
	      }
	      [ "$gr$gw" = '11' ] && {
		perm='read/write'
		change='g-rw'
	      }
	      message WARN perm021w "" "Disk device $fsdev has $perm access for group $group."
	      changelog "WARN : chmod : $change : $fsdev"
	    }
	  }
	}
      done
    done
  }
} |
$OUTPUTMETHOD
#
exit 0