aegis-rex 1.5.1 → 1.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aegis-rex",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "description": "Headless-drivable security auditor for Linux, macOS and Windows. Runs a 17-check local audit and can be driven by an AI agent (--capabilities / --audit --json / --fix). npm is the distribution channel; the tool itself is dependency-free Python.",
   "bin": {
     "rex": "bin/rex.js"

package/vendor/rex.py

@@ -118,7 +118,7 @@ IS_LINUX = _OS == "Linux"
 # ============================================================
 # KONFIGURATION
 # ============================================================
-VERSION  = "1.5.1"
+VERSION  = "1.5.2"
 APP_NAME = "ÆGIS Security Audit"
 
 # Lines emitted by find(1)/stat(1) *about* a path rather than *as a result*.
@@ -714,24 +714,45 @@ class AuditEngine:
                 return status, out or "No world-accessible binaries found in System32"
 
             else:  # Linux + macOS
-                safe_paths = ["/usr", "/bin", "/sbin", "/lib", "/lib64", "/opt"]
+                # Where a distro's package manager is allowed to drop a
+                # SUID/SGID binary. A stock Ubuntu box carries ~30 helpers in
+                # /usr/bin and /usr/lib (sudo, passwd, mount, su, pkexec …);
+                # reporting that inventory as a defect buries the one binary
+                # that was actually put there by hand. So the bit itself is
+                # inventoried, and only *where* it was found decides the status.
+                managed_dirs = (
+                    "/usr/bin/", "/usr/sbin/", "/usr/lib/", "/usr/lib32/",
+                    "/usr/lib64/", "/usr/libexec/", "/bin/", "/sbin/",
+                    "/lib/", "/lib32/", "/lib64/",
+                )
                 if IS_MAC:
-                    safe_paths = ["/usr", "/bin", "/sbin", "/opt"]
-                existing = [p for p in safe_paths if os.path.isdir(p)]
-                out = cmd(["find"] + existing + ["-perm", "/6000", "-type", "f"], timeout=20)
+                    managed_dirs = ("/usr/bin/", "/usr/sbin/", "/usr/lib/",
+                                    "/usr/libexec/", "/bin/", "/sbin/", "/System/")
+                # /home is deliberately absent: a recursive scan of home dirs
+                # exceeded 120s on a real machine, and an audit that stalls is
+                # worse than one with a stated scope. The remaining roots are
+                # sub-second.
+                scan_roots = ["/usr", "/bin", "/sbin", "/lib", "/lib64",
+                              "/usr/local", "/opt", "/tmp", "/var/tmp"]
+                existing = [p for p in scan_roots if os.path.isdir(p)]
+                out = cmd(["find"] + existing + ["-perm", "/6000", "-type", "f"], timeout=25)
                 real, noise = self._split_noise(out)
-                if real:
-                    lines = real[:30]
-                    out = "\n".join(lines)
-                    if len(lines) == 30:
-                        out += "\n[truncated at 30 results]"
-                    if noise:
-                        out += f"\n({len(noise)} path(s) not readable, skipped)"
-                    return "warn", out
-                note = "No SUID/SGID files found in system dirs"
-                if noise:
-                    note += f" ({len(noise)} path(s) not readable, skipped)"
-                return "ok", note
+                managed = [f for f in real if f.startswith(managed_dirs)]
+                unexpected = [f for f in real if not f.startswith(managed_dirs)]
+                suffix = f"\n({len(noise)} path(s) not readable, skipped)" if noise else ""
+                if unexpected:
+                    lines = unexpected[:30]
+                    body = "\n".join(lines)
+                    if len(unexpected) > 30:
+                        body += f"\n[truncated at 30 of {len(unexpected)} results]"
+                    if managed:
+                        body += (f"\n({len(managed)} SUID/SGID binary(ies) under "
+                                 f"distro-managed paths, expected inventory)")
+                    return "warn", body + suffix
+                if managed:
+                    return "ok", (f"{len(managed)} SUID/SGID binaries found, all under "
+                                  f"distro-managed paths (expected inventory)" + suffix)
+                return "ok", "No SUID/SGID files found in scanned paths" + suffix
 
         # ── World-Writable Files ──────────────────────────────
         elif section == "World-Writable Files":