--- ebuild.sh.orig 2003-08-20 21:02:27.000000000 -0400 +++ ebuild.sh 2003-09-22 00:13:35.000000000 -0400 @@ -105,7 +105,7 @@ for x in "$@"; do if [ "${x}" == "${me}" ]; then - tty --quiet < /dev/stdout || echo "${x}" + [ -w /dev/stdout ] && tty --quiet < /dev/stdout || echo "${x}" return 0 fi done @@ -803,6 +822,38 @@ find ${D}/ -group portage -print0 | $XARGS -0 -n100 chgrp root fi + if has sfperms ${FEATURES} > /dev/null ; then + sfconf=/etc/sfperms.conf + echo ">>> Preforming suid scan in ${D}" + for i in $(find ${D}/ -type f \( -perm -4000 -o -perm -2000 \) ); do + if [ -s ${sfconf} ]; then + suid="`grep ^${i/${D}/}$ ${sfconf}`" + if [ "${suid}" = "${i/${D}/}" ]; then + echo "- ${i/${D}/} is an approved suid file" + else + for x in 5 4 3 2 1 0; do + echo -ne "\a"; sleep 0.25 + done + echo "Removing sbit on non registered ${i/${D}/}" + echo -ne "\a"; sleep 2 + chmod ugo-s "${i}" + #grep ^#${i/${D}/}$ ${sfconf} > /dev/null || { + #echo ">>> Appending commented out entry to ${sfconf}" + #buffer=`ls -ldh "${i}" | awk '{print "##",$0}' | sed s/${D}//g` + # sandbox prevents us from writing directly to files outside of + # the sandbox, but this can easly be bypassed using a static binary + # -- Nope guess I was wrong.. + # sash -c "echo ${buffer} >> ${sfconf}" + # echo "#${i/${D}/} " >> ${sfconf} + #} + + fi + else + echo "sfperms feature set but you are lacking a ${sfconf}" + fi + done + fi + if use selinux; then if [ -x /usr3/sbin/setfiles ]; then if [ -e ${POLICYDIR}/file_contexts/file_contexts ]; then