Find security-relevant file contexts in a package

Finds file contexts – files in an R package that can be executed by R CMD build, R CMD check, or R CMD INSTALL (e.g., configure, src/Makevars, src/install.libs.R).

Usage

find_file_contexts(pkg, file_context_rules)

Arguments

pkg

Path to the root of the package being audited. Must exist and be a directory.

file_context_rules

Data frame of file-context rules (rules$file_contexts from load_rules()), with columns name, path, recursive, filename, and message.

Value

A list with two data frames:

file_contexts

Data frame with columns rule (the matching rule's name), file_context (package-root-relative path; the join key), and message. The phase columns are not set here; audit_package() attaches them from the rules database.

errors

Data frame with columns step, file_context, rule, message.

Security considerations

A rule whose directory is absent contributes nothing and reports nothing – most packages have no R/unix/, and that is a clean result. pkg itself is checked so that a root that does not exist is refused rather than joining that silence as a package with nothing to scan.

A symlinked file is never claimed: following it would attribute findings to the target's path rather than the one the package ships. It is reported in coverage as unexamined with reason symlink, so skipping it is stated rather than silent.