"Safe file system permissions" should test the ownership of files and directories

3.x work is now addressed in this issue: 🐛 file check is problematic "green" when not test with chmod Needs work

The related issue is more important because it directly tests the possibilty to change the ability to change permissions. The file owner check should maybe be separate because there could be server strategies to avoid changes of permissions like chattr and the ownership of a file cannot be used for changing permissions. And if this is the case it would be helpful to deactivate this check.

Because "SecurityReviewData->findWritableFiles" is already checking the fileowner I think it would be a good idea to move this code to another function which could return two the values writable and possibly writeable because of ownership. For backward compatiblity we can keep the old function as wrapper.

Hello @c-logemann since it's been a few months wonder if you want me to un-assign?

I hope in winter I find some time to push the file permission issues forward if no one else step in.

Sounds good! I'll be around and appreciate the super quick reply.