EVERYTHING FROM THE OTHER REPO
This commit is contained in:
@@ -0,0 +1,10 @@
|
||||
# the private library is for internal sharing only
|
||||
apt: package-name-doesnt-match-sonames
|
||||
apt: exit-in-shared-library [usr/lib*/libapt-private.so.0.0.0]
|
||||
# we are implementing our own fallback and it is a minor usecase only
|
||||
apt: missing-depends-on-sensible-utils sensible-pager [usr/lib*/libapt-private.so.0.0.0]
|
||||
# these man pages document usage/config for things called via apt
|
||||
apt: spare-manual-page [usr/share/man*/man1/apt-transport-http.1.gz]
|
||||
apt: spare-manual-page [usr/share/man*/man1/apt-transport-https.1.gz]
|
||||
apt: spare-manual-page [usr/share/man*/man1/apt-transport-mirror.1.gz]
|
||||
apt: spare-manual-page [usr/share/man*/man8/apt-secure.8.gz]
|
||||
@@ -0,0 +1,43 @@
|
||||
#
|
||||
# Permissions 0700 on /root are intentional as people expect
|
||||
# the /root directory to be more private than /home/* directories.
|
||||
#
|
||||
base-files: non-standard-dir-perm 0700 != 0755 [root/]
|
||||
#
|
||||
# The /etc/os-release symlink is relative on purpose to avoid breaking dracut.
|
||||
# See Bug #755394 for details.
|
||||
#
|
||||
base-files: relative-symlink ../usr/lib/os-release [etc/os-release]
|
||||
#
|
||||
# The purpose of having licenses here is precisely to allow
|
||||
# other packages to reference them.
|
||||
#
|
||||
base-files: extra-license-file [usr/share/common-licenses/Artistic]
|
||||
base-files: extra-license-file [usr/share/common-licenses/BSD]
|
||||
base-files: extra-license-file [usr/share/common-licenses/GPL-1]
|
||||
base-files: extra-license-file [usr/share/common-licenses/GPL-2]
|
||||
base-files: extra-license-file [usr/share/common-licenses/GPL-3]
|
||||
base-files: extra-license-file [usr/share/common-licenses/LGPL-2]
|
||||
base-files: extra-license-file [usr/share/common-licenses/LGPL-2.1]
|
||||
base-files: extra-license-file [usr/share/common-licenses/LGPL-3]
|
||||
#
|
||||
# These links really should be relative.
|
||||
#
|
||||
base-files: relative-symlink usr/bin [bin]
|
||||
base-files: relative-symlink usr/lib [lib]
|
||||
base-files: relative-symlink usr/lib64 [lib64]
|
||||
base-files: relative-symlink usr/libx32 [libx32]
|
||||
base-files: relative-symlink usr/sbin [sbin]
|
||||
#
|
||||
# We need these for the relevant architectures.
|
||||
#
|
||||
base-files: non-multi-arch-lib-dir [usr/lib64/]
|
||||
base-files: non-multi-arch-lib-dir [usr/libx32/]
|
||||
#
|
||||
# The following directories have become symlinks.
|
||||
#
|
||||
base-files: file-in-unusual-dir [bin]
|
||||
base-files: file-in-unusual-dir [lib64]
|
||||
base-files: file-in-unusual-dir [lib]
|
||||
base-files: file-in-unusual-dir [libx32]
|
||||
base-files: file-in-unusual-dir [sbin]
|
||||
@@ -0,0 +1 @@
|
||||
base-passwd: no-debconf-config
|
||||
@@ -0,0 +1,5 @@
|
||||
# no, used conditionally
|
||||
bash binary: manpage-has-errors-from-man
|
||||
|
||||
# we have NEWS, CHANGES and changelog ...
|
||||
bash binary: wrong-name-for-upstream-changelog
|
||||
@@ -0,0 +1 @@
|
||||
bsdutils: elevated-privileges 2755 root/tty [usr/bin/wall]
|
||||
@@ -0,0 +1,3 @@
|
||||
coreutils: custom-library-search-path RUNPATH /usr/lib/*
|
||||
coreutils: groff-message *warning: macro 'mono' not defined*
|
||||
coreutils: groff-message *warning: macro '/mono' not defined*
|
||||
@@ -0,0 +1,6 @@
|
||||
# we want prerm to be #!/bin/dash so that it runs no matter what
|
||||
dash binary: unusual-control-interpreter
|
||||
|
||||
# we work around missing debconf instead of depending on it
|
||||
# to reduce the dependencies of a minimal install
|
||||
dash binary: missing-debconf-dependency-for-preinst
|
||||
@@ -0,0 +1 @@
|
||||
debconf: postrm-does-not-purge-debconf
|
||||
@@ -0,0 +1,2 @@
|
||||
# Yes.
|
||||
dpkg: arch-dep-package-has-big-usr-share
|
||||
@@ -0,0 +1,2 @@
|
||||
# duh
|
||||
init-system-helpers: package-uses-local-diversion
|
||||
@@ -0,0 +1,2 @@
|
||||
# False positive, checked at compile time.
|
||||
libacl1: hardening-no-fortify-functions [*]
|
||||
@@ -0,0 +1,2 @@
|
||||
# False positive, checked at compile time.
|
||||
libattr1: hardening-no-fortify-functions [*]
|
||||
@@ -0,0 +1 @@
|
||||
libblkid1: missing-depends-on-sensible-utils sensible-pager [usr/lib/*/libblkid.so.1.1.0]
|
||||
@@ -0,0 +1,4 @@
|
||||
# The library provides APIs that do exit.
|
||||
libbsd0: exit-in-shared-library [usr/lib/*/libbsd.so.*]
|
||||
# We use a linker script.
|
||||
libbsd0: lacks-unversioned-link-to-shared-library example: usr/lib/*/libbsd.so [usr/lib/*/libbsd.so.*]
|
||||
@@ -0,0 +1,19 @@
|
||||
# ldconfig must be executable even when the libc is not configured, and
|
||||
# thus must be linked statically
|
||||
shared-library-lacks-prerequisites [usr/sbin/ldconfig]
|
||||
|
||||
# these manpages are provided by the manpages package
|
||||
no-manual-page [usr/sbin/ldconfig]
|
||||
no-manual-page [usr/bin/getent]
|
||||
no-manual-page [usr/bin/iconv]
|
||||
no-manual-page [usr/bin/ld.so]
|
||||
no-manual-page [usr/bin/ldd]
|
||||
no-manual-page [usr/bin/locale]
|
||||
no-manual-page [usr/bin/localedef]
|
||||
no-manual-page [usr/bin/pldd]
|
||||
no-manual-page [usr/bin/zdump]
|
||||
no-manual-page [usr/sbin/iconvconfig]
|
||||
no-manual-page [usr/sbin/zic]
|
||||
|
||||
# this non-standard permission is needed for security reasons
|
||||
non-standard-dir-perm 0700 != 0755 [var/cache/ldconfig/]
|
||||
@@ -0,0 +1,22 @@
|
||||
# ld.so must be executable, otherwise the system will not work
|
||||
shared-library-is-executable 0755 [*/ld*.so.*]
|
||||
|
||||
# It is normal that the ELF dynamic linker does not need any other
|
||||
# library
|
||||
shared-library-lacks-prerequisites */ld*.so.*
|
||||
|
||||
# A linker script is used instead of a symlink (see debian-policy bug#1095039)
|
||||
lacks-unversioned-link-to-shared-library * [*/libc.so.*]
|
||||
|
||||
# These are empty libraries shipped for backward compatibilities
|
||||
lacks-unversioned-link-to-shared-library * [*/libdl.so.*]
|
||||
lacks-unversioned-link-to-shared-library * [*/libpthread.so.*]
|
||||
lacks-unversioned-link-to-shared-library * [*/librt.so.*]
|
||||
lacks-unversioned-link-to-shared-library * [*/libutil.so.*]
|
||||
|
||||
# These are plugins and not general purpose libraries
|
||||
lacks-unversioned-link-to-shared-library * [*/libnss_dns.so.*]
|
||||
lacks-unversioned-link-to-shared-library * [*/libnss_files.so.*]
|
||||
|
||||
# dependency on debconf is not needed, as glibc has a fallback to tty
|
||||
missing-debconf-dependency-for-preinst
|
||||
@@ -0,0 +1,3 @@
|
||||
# historical reasons
|
||||
libdb5.3t64: package-name-doesnt-match-sonames libdb-5.3
|
||||
libdb5.3t64: package-name-doesnt-match-sonames libdb5.3
|
||||
@@ -0,0 +1 @@
|
||||
libgcc-s1: package-name-doesnt-match-sonames
|
||||
@@ -0,0 +1 @@
|
||||
libhogweed6t64: package-name-doesnt-match-sonames libhogweed6
|
||||
@@ -0,0 +1 @@
|
||||
libmount1: missing-depends-on-sensible-utils sensible-pager [usr/lib/*/libmount.so.1.1.0]
|
||||
@@ -0,0 +1 @@
|
||||
libnettle8t64: package-name-doesnt-match-sonames libnettle8
|
||||
@@ -0,0 +1,13 @@
|
||||
# These are false positives because they don't use any functions that need
|
||||
# fortifying. Since we know we have hardening turned on globally, suppress
|
||||
# them. If we ever see this warning again for *other* modules, then we know
|
||||
# there's a real problem.
|
||||
libpam-modules: hardening-no-fortify-functions *usr/lib/*/security/pam_echo.so*
|
||||
libpam-modules: hardening-no-fortify-functions *usr/lib/*/security/pam_filter.so*
|
||||
libpam-modules: hardening-no-fortify-functions *usr/lib/*/security/pam_group.so*
|
||||
libpam-modules: hardening-no-fortify-functions *usr/lib/*/security/pam_localuser.so*
|
||||
libpam-modules: hardening-no-fortify-functions *usr/lib/*/security/pam_shells.so*
|
||||
libpam-modules: hardening-no-fortify-functions *usr/lib/*/security/pam_wheel.so*
|
||||
# pam_deny.so does not use any symbol from libc.
|
||||
libpam-modules: shared-lib-without-dependency-information *usr/lib/*/security/pam_deny.so*
|
||||
libpam-modules: spare-manual-page [*]
|
||||
@@ -0,0 +1,2 @@
|
||||
# yes, we know it's sgid, that's the whole point...
|
||||
libpam-modules-bin: elevated-privileges 2755 root/shadow [usr/sbin/unix_chkpwd]
|
||||
@@ -0,0 +1,13 @@
|
||||
# deliberate.
|
||||
libpam-runtime: no-debconf-config
|
||||
# this warning is just plain crack, there's no reason that using debconf
|
||||
# outside of a maintainer script implies an error.
|
||||
libpam-runtime: debconf-is-not-a-registry [*usr/sbin/pam-auth-update*:*]
|
||||
# false positive, we have to load the debconf templates from here
|
||||
libpam-runtime: uses-dpkg-database-directly [usr/sbin/pam-auth-update]
|
||||
# and lintian also says these templates are unused, which is false
|
||||
libpam-runtime: unused-debconf-template libpam-runtime/conflicts [*:*]
|
||||
libpam-runtime: unused-debconf-template libpam-runtime/no_profiles_chosen [*:*]
|
||||
libpam-runtime: unused-debconf-template libpam-runtime/override [*:*]
|
||||
libpam-runtime: unused-debconf-template libpam-runtime/profiles [*:*]
|
||||
libpam-runtime: unused-debconf-template libpam-runtime/title [*:*]
|
||||
@@ -0,0 +1,11 @@
|
||||
# obvious multilib package false-positive; also the package name hasn't
|
||||
# changed since the glibc transition, go us!
|
||||
libpam0g: package-name-doesnt-match-sonames libpam-misc0 libpam0 libpamc0
|
||||
# yes, these are deliberately asked in the postinst because the checking
|
||||
# for daemons to be restarted needs to be done in the postinst and not
|
||||
# before
|
||||
libpam0g: no-debconf-config
|
||||
libpam0g: postinst-uses-db-input
|
||||
# Yes, we want to use systemctl; if the service is running we do need
|
||||
# to restart it. We have already asked the admin.
|
||||
libpam0g: maintainer-script-calls-systemctl
|
||||
@@ -0,0 +1 @@
|
||||
libsmartcols1: missing-depends-on-sensible-utils sensible-pager [usr/lib/*/libsmartcols.so.1.1.0]
|
||||
@@ -0,0 +1 @@
|
||||
libssl3t64: package-name-doesnt-match-sonames libssl3
|
||||
@@ -0,0 +1 @@
|
||||
login: elevated-privileges 4755 root/root [usr/bin/newgrp]
|
||||
@@ -0,0 +1,2 @@
|
||||
mount: elevated-privileges 4755 root/root [usr/bin/mount]
|
||||
mount: elevated-privileges 4755 root/root [usr/bin/umount]
|
||||
@@ -0,0 +1,2 @@
|
||||
# The description refers to the terminfo entry which is lowercase.
|
||||
ncurses-base: capitalization-error-in-description linux Linux
|
||||
@@ -0,0 +1,6 @@
|
||||
passwd: elevated-privileges 2755 root/shadow [usr/bin/chage]
|
||||
passwd: elevated-privileges 4755 root/root [usr/bin/chfn]
|
||||
passwd: elevated-privileges 4755 root/root [usr/bin/chsh]
|
||||
passwd: elevated-privileges 2755 root/shadow [usr/bin/expiry]
|
||||
passwd: elevated-privileges 4755 root/root [usr/bin/gpasswd]
|
||||
passwd: elevated-privileges 4755 root/root [usr/bin/passwd]
|
||||
@@ -0,0 +1,5 @@
|
||||
# we never want these unpacked at the same time, they break maintainer scripts
|
||||
conflicts-with-version safe-rm (<< 0.8)
|
||||
# There is logic in the unicode handling code which deals with this typo
|
||||
spelling-error-in-binary usr/bin/perl Inseperable Inseparable
|
||||
spelling-error-in-binary usr/bin/perl5.40.1 Inseperable Inseparable
|
||||
@@ -0,0 +1,12 @@
|
||||
# Variable tzdata/Zones/$AREA used
|
||||
unused-debconf-template tzdata/Zones/Africa *
|
||||
unused-debconf-template tzdata/Zones/America *
|
||||
unused-debconf-template tzdata/Zones/Antarctica *
|
||||
unused-debconf-template tzdata/Zones/Arctic *
|
||||
unused-debconf-template tzdata/Zones/Asia *
|
||||
unused-debconf-template tzdata/Zones/Atlantic *
|
||||
unused-debconf-template tzdata/Zones/Australia *
|
||||
unused-debconf-template tzdata/Zones/Etc *
|
||||
unused-debconf-template tzdata/Zones/Europe *
|
||||
unused-debconf-template tzdata/Zones/Indian *
|
||||
unused-debconf-template tzdata/Zones/Pacific *
|
||||
@@ -0,0 +1,2 @@
|
||||
# Yes, su really needs to be suid ofcourse...
|
||||
util-linux: elevated-privileges 4755 root/root [usr/bin/su]
|
||||
Reference in New Issue
Block a user