Verified Commit 74e8166c authored by Minecrell's avatar Minecrell 😵 Committed by Oliver Smith
Browse files

main/postmarketos-base: fix file permissions of /etc/sudoers (MR 2610)

Installing postmarketos-base currently changes the file permissions
of /etc/sudoers:

  # apk add sudo
  # stat /etc/sudoers
  Access: (0440/-r--r-----)  Uid: (    0/    root)   Gid: (    0/    root)

  # apk add postmarketos-base
  # stat /etc/sudoers
  Access: (0044/----r--r--)  Uid: (    0/    root)   Gid: (    0/    root)

The file mode 0044 decodes to:
  - User *cannot* read
  - Group can read
  - Other can read

which does not make any sense. The "sudoers" man page makes it very
clear that this file should have a file mode of 0440 [1]
("readable by owner and group, writable by none").

This looks like a bad typo. However, given that only read permissions
were given out this shouldn't have major security implications
(except allowing all users to see who can use sudo).
Install the file with 0440 instead of 0044 to fix this:

  # apk add postmarketos-base
  # stat /etc/sudoers
  Access: (0440/-r--r-----)  Uid: (    0/    root)   Gi...
parent c77fcd95
Pipeline #389751482 passed with stages
in 2 minutes and 32 seconds
pkgname=postmarketos-base
pkgver=15
pkgrel=0
pkgrel=1
pkgdesc="Meta package for minimal postmarketOS base"
url="https://postmarketos.org"
arch="noarch"
......@@ -29,7 +29,7 @@ replaces="
"
replaces_priority=100 # leave plenty for alpine
_source044="
_source440="
etc/sudoers
"
_source644="
......@@ -59,7 +59,7 @@ flatpath() {
done
}
source="$(flatpath $_source044 $_source644 $_source755)"
source="$(flatpath $_source440 $_source644 $_source755)"
prepare() {
default_prepare
......@@ -70,8 +70,8 @@ prepare() {
package() {
local i
for i in $_source044; do
install -Dm044 "$srcdir/$(flatpath "$i")" "$pkgdir/$i"
for i in $_source440; do
install -Dm440 "$srcdir/$(flatpath "$i")" "$pkgdir/$i"
done
for i in $_source644; do
install -Dm644 "$srcdir/$(flatpath "$i")" "$pkgdir/$i"
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment