diff --git a/abuild.in b/abuild.in index 18a8c8c1c1ff93e72f5d30486da06dbca4175df9..9758f85497bec7f915655ec38b613a2a98b53f5d 100755 --- a/abuild.in +++ b/abuild.in @@ -552,6 +552,15 @@ postcheck() { warning "World writeable directories found:" echo "$i" fi + # check so we dont have any suid root binaries that are not + i=$(find "$dir" -type f -perm +6000 \ + | xargs scanelf --nobanner --etype ET_EXEC \ + | sed "s|ET_EXEC $dir|\t|") + if [ -n "$i" ]; then + error "Found non-PIE files that has SUID:" + echo "$i" + return 1 + fi return 0 }