main/postmarketos-base: fix file permissions of /etc/sudoers (MR 2610)

Installing postmarketos-base currently changes the file permissions
of /etc/sudoers:

  # apk add sudo
  # stat /etc/sudoers
  Access: (0440/-r--r-----)  Uid: (    0/    root)   Gid: (    0/    root)

  # apk add postmarketos-base
  # stat /etc/sudoers
  Access: (0044/----r--r--)  Uid: (    0/    root)   Gid: (    0/    root)

The file mode 0044 decodes to:
  - User *cannot* read
  - Group can read
  - Other can read

which does not make any sense. The "sudoers" man page makes it very
clear that this file should have a file mode of 0440 [1]
("readable by owner and group, writable by none").

This looks like a bad typo. However, given that only read permissions
were given out this shouldn't have major security implications
(except allowing all users to see who can use sudo).
Install the file with 0440 instead of 0044 to fix this:

  # apk add postmarketos-base
  # stat /etc/sudoers
  Access: (0440/-r--r-----)  Uid: (    0/    root)   Gid: (    0/    root)

[1]: https://www.sudo.ws/man/1.9.8/sudoers.man.html#Error_log_entries
This commit is contained in:
Minecrell 2021-10-16 12:36:41 +02:00 committed by Oliver Smith
parent c77fcd959f
commit 74e8166c7d
No known key found for this signature in database
GPG key ID: 5AE7F5513E0885CB

View file

@ -1,6 +1,6 @@
pkgname=postmarketos-base pkgname=postmarketos-base
pkgver=15 pkgver=15
pkgrel=0 pkgrel=1
pkgdesc="Meta package for minimal postmarketOS base" pkgdesc="Meta package for minimal postmarketOS base"
url="https://postmarketos.org" url="https://postmarketos.org"
arch="noarch" arch="noarch"
@ -29,7 +29,7 @@ replaces="
" "
replaces_priority=100 # leave plenty for alpine replaces_priority=100 # leave plenty for alpine
_source044=" _source440="
etc/sudoers etc/sudoers
" "
_source644=" _source644="
@ -59,7 +59,7 @@ flatpath() {
done done
} }
source="$(flatpath $_source044 $_source644 $_source755)" source="$(flatpath $_source440 $_source644 $_source755)"
prepare() { prepare() {
default_prepare default_prepare
@ -70,8 +70,8 @@ prepare() {
package() { package() {
local i local i
for i in $_source044; do for i in $_source440; do
install -Dm044 "$srcdir/$(flatpath "$i")" "$pkgdir/$i" install -Dm440 "$srcdir/$(flatpath "$i")" "$pkgdir/$i"
done done
for i in $_source644; do for i in $_source644; do
install -Dm644 "$srcdir/$(flatpath "$i")" "$pkgdir/$i" install -Dm644 "$srcdir/$(flatpath "$i")" "$pkgdir/$i"