Closed bndnico closed 1 year ago
I realize this is 5 years late, but this module has just quietly been working without issue and hasn't gotten much attention for that reason :)
Using the full list of groups would be a good improvement, since if any of them match the gid on the file, they should be considered part of the group.
However, using fs.access
is not ideal, since on linux (but not bsd systems like macOS), it uses the actual uid/gid/groups, rather than the effective uid/gid/groups. This is a security feature in some cases, because it allows setuid executables to determine what files the user actually has access to, but it also means that if you run the initial process as the root user, and then downgrade permissions by using process.setgid()
and process.setuid()
, you'll get the wrong answer. On bsd systems, this behavior is reversed, making it even more confusing.
Also, this module lets you specify an effective uid/gid, which there's of course no way to provide to access(2)
.
On Linux, the isexe module does not recognize an executable file as being executable when
So a file with the permissions
rwxrwx---
with user=nobody and group=adm is not recognized as executable, even though my user is a member of the group "adm" and the group "adm" does have the "x" permission on that particular file. On the shell however, the file executes just fine!In mode.js,
process.getgid()
is used the get the current main groups. However, all secondary groups of the current user are not checked. I think mode.js should useprocess.getgroups()
instead and check every group. (Or maybe just useprocess.access()
like https://www.npmjs.com/package/is-executable does?)Demonstration:
Set up a test project and install "isexe" module
Create a simple executable file and test it
So I can run this program on the terminal and "isexe" returns
1
which is truthy, so everything seems to be in order correct.Change the file ownership and test it again
First, I restrict the file permissions to 770, so only the owner and members of the group can access the file. Then I set the owner to "nobody" and the group to "adm". Note that those values are rather arbitrary. I chose them because they are present on most systems and my user is already a member of the "adm" group.
As you can see I can still execute the file (as expected), but "isexe" now returns
false
, which is incorrect.Some version information