Yasat write issue

[noraj]

Bug description

$ yasat --html --html-output /tmp/yasat.html 
Found /etc/yasat/yasat.conf
Enabling output in /home/noraj/.yasat/yasat.html
HTML output is /tmp/yasat.html
  Using YASAT version                                              [ 848 ]
  Using YASAT with UID!=0 Some test may fail                       [ WARNING ]

Press ENTER to continue Ctrl/C to quit

  Using YASAT without SELinux                                      [ OK ]
  Detecting OS...                                                  [ DONE ]
    arch Linux ArchLinux
  Detecting TERM width...                                          [ 236 ]
Color chart
 GREEN   is for good configuration or information
 RED     is for configuration that must be corrected
 ORANGE  is for optional configuration that can be done
 BLUE    is for information

At the end of the audit, the report will be available at /home/noraj/.yasat//yasat.report

ls: cannot access '/usr/share/yasat/plugins//*.advice': Permission denied
/usr/bin/yasat: line 508: /usr/share/yasat//yasat.advices: Permission denied

ls: cannot access '/usr/share/yasat/plugins//*test': Permission denied

Yasat tries to write in it's root directory (/usr/share/yasat) but can't without root priv

https://github.com/montjoie/yasat/blob/0eead3d12d2cfa9b0bb69ba16f3319f2dbc682f2/yasat#L508

I'm wondering if there is a possibility to modify the configuration to be able to run the tool without root priv.

https://github.com/BlackArch/blackarch/blob/master/packages/yasat/yasat.conf

[D3vil0p3r]

@noraj It is needed to add a control that check if the tool is run as root (or by sudo) and, if not, write in home folder... I can try to rewrite the code of that tool, submit a PR and push on the maintainer for merging. If you agree with this approach on the code, I will do it. Let me know.

[D3vil0p3r]

Btw I just fixed and tested the code. I opened a PR upstream montjoie/yasat#1

[D3vil0p3r]

I updated the PKGBUILD with a prepare() statement to fix the reported issue. When/If the upstream PR will be merged, we can remove prepare()