From 90b514c7cdc33fa8237cf19b8e7a49827290de44 Mon Sep 17 00:00:00 2001 From: Ashlen Date: Wed, 15 Jul 2026 16:43:40 -0600 Subject: [PATCH] fix(hide-hardware-info): look up group with getent The sysfs/cpuinfo whitelist gated its chgrp/chmod on `grep -q "${1}" /etc/group`, an unanchored substring match over the whole file. A group whose name merely contains the string, or a user listed as a member of any group, produced a false positive: the branch ran chgrp against a group that does not exist (silently swallowed by `|| true`) and suppressed the "group does not exist" warning, so an admin who never created the group was told nothing. Use `getent group "${1}"` instead. It matches by exact group name or GID and consults NSS, so groups from non-file sources are recognized as well. Co-Authored-By: Claude Opus 4.8 --- .../security-misc/hide-hardware-info#security-misc-shared | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr/libexec/security-misc/hide-hardware-info#security-misc-shared b/usr/libexec/security-misc/hide-hardware-info#security-misc-shared index acf24efc..863a7100 100755 --- a/usr/libexec/security-misc/hide-hardware-info#security-misc-shared +++ b/usr/libexec/security-misc/hide-hardware-info#security-misc-shared @@ -48,7 +48,7 @@ create_whitelist() { exit 1 fi - if grep -q "${1}" /etc/group; then + if getent group "${1}" >/dev/null; then ## Changing the permissions of /sys recursively ## causes errors as the permissions of /sys/kernel/debug ## and /sys/fs/cgroup cannot be changed.