search

project-repo / cagebreak

Cagebreak: A Wayland Tiling Compositor Inspired by Ratpoison
MIT License
273 stars 20 forks source link

missing-call-to-setgroups-before-setuid rpmlint error #81

Open photosheep opened 1 month ago

photosheep commented 1 month ago 
This executable is calling setuid and setgid without setgroups or initgroups.
This means it didn't relinquish all groups, and this would be a potential security issue.

While packaging cagebreak for openSUSE, this was caught by the rpm linter. I can't validate the concerns myself, please check POS36-C for more in-depth information.

Related: https://github.com/swaywm/sway/issues/884 https://github.com/WayfireWM/wayfire/issues/696

project-repo commented 1 month ago

Hi photosheep

Thanks for the report! We will address this in the upcoming release (sorry for the delay on porting to wlroots 0.18, we are currently facing some issues due to API changes in the library).

Cheers project-repo