forge/pmaports
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

main/postmarketos-base: fix file permissions of /etc/sudoers (MR 2610)

Browse source 
Installing postmarketos-base currently changes the file permissions
of /etc/sudoers:

  # apk add sudo
  # stat /etc/sudoers
  Access: (0440/-r--r-----)  Uid: (    0/    root)   Gid: (    0/    root)

  # apk add postmarketos-base
  # stat /etc/sudoers
  Access: (0044/----r--r--)  Uid: (    0/    root)   Gid: (    0/    root)

The file mode 0044 decodes to:
  - User *cannot* read
  - Group can read
  - Other can read

which does not make any sense. The "sudoers" man page makes it very
clear that this file should have a file mode of 0440 [1]
("readable by owner and group, writable by none").

This looks like a bad typo. However, given that only read permissions
were given out this shouldn't have major security implications
(except allowing all users to see who can use sudo).
Install the file with 0440 instead of 0044 to fix this:

  # apk add postmarketos-base
  # stat /etc/sudoers
  Access: (0440/-r--r-----)  Uid: (    0/    root)   Gid: (    0/    root)

[1]: https://www.sudo.ws/man/1.9.8/sudoers.man.html#Error_log_entries
This commit is contained in:
Minecrell 2021-10-16 12:36:41 +02:00 committed by Oliver Smith
parent c77fcd959f
commit 74e8166c7d
No known key found for this signature in database
GPG key ID: 5AE7F5513E0885CB
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
main/postmarketos-base/APKBUILD
View file

@ -1,6 +1,6 @@
pkgname=postmarketos-base
pkgver=15
pkgrel=0
pkgrel=1
pkgdesc="Meta package for minimal postmarketOS base"
url="https://postmarketos.org"
arch="noarch"
@ -29,7 +29,7 @@ replaces="
"
replaces_priority=100 # leave plenty for alpine
_source044="
_source440="
etc/sudoers
"
_source644="
@ -59,7 +59,7 @@ flatpath() {
done
}
source="$(flatpath $_source044 $_source644 $_source755)"
source="$(flatpath $_source440 $_source644 $_source755)"
prepare() {
default_prepare
@ -70,8 +70,8 @@ prepare() {
package() {
local i
for i in $_source044; do
install -Dm044 "$srcdir/$(flatpath "$i")" "$pkgdir/$i"
for i in $_source440; do
install -Dm440 "$srcdir/$(flatpath "$i")" "$pkgdir/$i"
done
for i in $_source644; do
install -Dm644 "$srcdir/$(flatpath "$i")" "$pkgdir/$i"