lint: warn about potential UID/GID drift under /etc; respect tmpfiles chown (z/Z) (#1562)#1570
Open
rishi-jat wants to merge 2 commits intobootc-dev:mainfrom
Open
lint: warn about potential UID/GID drift under /etc; respect tmpfiles chown (z/Z) (#1562)#1570rishi-jat wants to merge 2 commits intobootc-dev:mainfrom
rishi-jat wants to merge 2 commits intobootc-dev:mainfrom
Conversation
Loading
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This adds a new container lint (etc-uid-drift) that warns when files or directories under /etc are owned by non-root users or groups that aren’t numerically pinned in systemd-sysusers and aren’t covered by systemd-tmpfiles chown rules. The goal is to help catch ownership that can “drift” across upgrades when /etc persists.
The lint parses usr/lib/sysusers.d to find users/groups with fixed numeric IDs, and scans usr/lib/tmpfiles.d for z/Z entries (chown at boot, either exact or recursive). It walks /etc (skipping symlinks, handling non‑UTF8 paths), and warns on entries where uid/gid is non-root, not pinned via sysusers, and not covered by a tmpfiles chown. For example, if a component uses a floating user but ships a tmpfiles rule like Z /etc/polkit-1/…, the lint will not warn.
This is a warning-only check (can be promoted to fatal with --fatal-warnings) and does not change runtime behavior.
Fixes #1562