Reproduction
Static probes emit PE2 for both of these scanner inputs:
chmod 600 "$SERVER_ID_FILE"
chmod 0644 notes.txt
The probes also detect chmod 4755 helper and chmod u+s helper. Reporting the ordinary restrictive modes as privilege escalation solely because of their digit patterns misstates the operation.
Expected behavior
Check the complete permission change. Preserve findings for setuid and other dangerous permission changes, and make uncertainty clear when a mode cannot be resolved. Cover restrictive and dangerous modes, including quoted, symbolic and malformed inputs.
This is a detector correction under the existing scoring policy.
Relevant code
static_patterns_privilege_escalation.py:81.
Reproduction
Static probes emit PE2 for both of these scanner inputs:
The probes also detect
chmod 4755 helperandchmod u+s helper. Reporting the ordinary restrictive modes as privilege escalation solely because of their digit patterns misstates the operation.Expected behavior
Check the complete permission change. Preserve findings for setuid and other dangerous permission changes, and make uncertainty clear when a mode cannot be resolved. Cover restrictive and dangerous modes, including quoted, symbolic and malformed inputs.
This is a detector correction under the existing scoring policy.
Relevant code
static_patterns_privilege_escalation.py:81.