Packagemanager-LFS-PackageUser-System git · main

# setid.conf -- files that MUST carry a setuid or setgid bit.
#
# A package user cannot set these bits: chmod 4711 as p_shadow is refused by
# the kernel, and `lfs-helper setid` exists to apply the ones a build ASKED
# for and was refused.  These are different -- the build never asks.  The
# LFS Shadow page sets 4711 on /usr/bin/su and the BLFS page does not, so a
# BLFS-driven reinstall of shadow leaves su non-setuid and `su` stops
# working, with nothing recorded anywhere to notice it.
#
# So they are declared here, and `cfg shadow-pam` (and any install that
# touches these paths) applies them.  Nothing here is guessed: each line is
# what LFS or BLFS sets on that file.
#
#   path | mode | owner | group | package
#
# GROUP IS KEPT AS THE PACKAGE USER where that is how the file arrived:
# ownership follows the installer in this system, and only the USER needs to
# be root for a setuid bit to mean root.  `-` keeps whatever is there.
#
# PACKAGE is the 5th column and it is a lock, not documentation (1.14.310).
# The lease hands a root-owned file to a package user for the length of a
# build phase, and "the file is setuid" used to be reason enough.  It is not:
# a manifest is built by TIME WINDOW, so a webkitgtk build that happened to
# be running while `cfg shadow-pam` touched /usr/bin/su recorded su as its
# own -- and the next webkitgtk build leased it, chowned it (which clears the
# setuid bit silently) and left `su` as `p_webkitgtk 0711`.  Three times.
# Now only the package named here may be handed the file.  A line without a
# package is leased to nobody.

# Shadow: su must be setuid root or nobody can become another account.
# The other four are setuid root on every distribution and in LFS.
/usr/bin/su       | 4711 | root | - | shadow
/usr/bin/passwd   | 4711 | root | - | shadow
/usr/bin/chage    | 4711 | root | - | shadow
/usr/bin/gpasswd  | 4711 | root | - | shadow
/usr/bin/newgrp   | 4711 | root | - | shadow
# ...AND THE FOUR THE FIRST LIST MISSED.  shadow's own install asked for
# nine setuid bits and setid.conf declared five of them; these are the rest,
# read off that request list rather than guessed.
/usr/bin/chfn      | 4711 | root | - | shadow
/usr/bin/chsh      | 4711 | root | - | shadow
/usr/bin/newgidmap | 4711 | root | - | shadow
/usr/bin/newuidmap | 4711 | root | - | shadow

# Linux-PAM: its own page sets this one, and its install runs as the
# package user, so the chmod there is refused the same way.
/usr/sbin/unix_chkpwd | 4755 | root | - | linux-pam

# D-Bus: BLFS installs the launch helper 4750 root:messagebus.  Here the
# GROUP is the point -- only messagebus may run it.  (This line lived only
# inside lfs-helper until 1.14.263; setid.conf is the one table now.)
/usr/libexec/dbus-daemon-launch-helper | 4750 | root | messagebus | dbus

# NOT HERE, AND ON PURPOSE: halt, poweroff and reboot.
#
# They carry 4550 root:<collector>_power -- setuid root so they can turn the
# machine off, and executable ONLY by that group, which is what makes "the
# desktop user may reboot" a membership rather than a password.  The group's
# NAME is configured (collector_prefix, or POWER_GROUP), so it cannot be
# written down here: a line saying `| root | -` would keep whatever group the
# file happens to have, and on a machine where `cfg power` has not run yet
# that is p_sysvinit -- handing shutdown to whoever builds sysvinit.
#
# `cfg power` is the one place that knows the group, and since 1.14.309 it
# carries an expect= that re-checks the mode and owner on every stack run:
#     packagemanager stack services --only power --run
# A `chown` clears setuid without a word (see 1.14.308), so this is checked
# rather than assumed.

# fcron: fcrontab (and fcrondyn) are setuid root and setgid fcron, so users
# can edit their own crontabs and the daemon reads them; fcronsighup tells
# the daemon to reload.  WITHOUT A LINE HERE A REINSTALL FAILS: the files
# are root's after the first install, and the lease hands a root setid file
# only to the package named in this column --
#     install: cannot remove '/usr/bin/fcrontab': Operation not permitted
# fcrontab's mode is what this machine has (6755 root:fcron).  The other two
# take "-": the mode the file had before the phase, put back after it.
/usr/bin/fcrontab    | 6755 | root | fcron | fcron
/usr/bin/fcrondyn    | -    | root | -     | fcron
/usr/bin/fcronsighup | -    | root | -     | fcron