The security-check target in Mk/bsd.port.mk misses binaries that are installed setuid by pkg(8).

${WRKDIR}/.PLIST.setuid is currently populated by parsing the package's plist and identifying installed files with the setuid or setgid bits present. Binaries may also be installed setuid or setgid when pkg register is run as part of the install process. This happens here. As written, there is no mechanism implemented in the security-check target to detect such setuid/setgid file mode modifications.

This revision causes files with pkg-plist keywords matching ^@\(([^,)]*,){2}[246][0-7]([1357][0-7]|[0-7][1357])\) to be appended to ${WRKDIR}/.PLIST.setuid so that they are included in the warning message generated by ${SCRIPTSDIR}/security-check.awk.

Tested discovery of setuid binaries by changing bin/feh in graphics/feh to all possible configurations and spot tested the test-case results. Full results are linked below.

• @(root,wheel,4644) bin/feh - no warning
• @(,,4555) bin/feh - prints warning
• @(,,2555) bin/feh - prints warning
• @(root,,6444) bin/feh -no warning
• @(,,4544) bin/feh - no warning
• @(,,2544) bin/feh - no warning
• @(,,0555) bin/feh - no warning
• @(,,755) bin/feh - no warning

Script used to generate unit test cases: Link to GitHub Gist

Positive (triggered) test cases: Link to GitHub Gist
Negative (not triggered) test cases: Link to GitHub Gist
Full test suit output: Link to GitHub Gist