Add explanations for the Lintian overrides

diff --git a/debian/changelog b/debian/changelog
index bad38865b299de9732dafbf84e66c413e64cf28f..88d94c8d5d4bbbe30804d3e343bc7ea650464ce0 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -33,6 +33,7 @@ openafs (1.4.8.dfsg1-1) UNRELEASED; urgency=low
   * Allow time-daemon to satisfy the openafs-fileserver recommends in
     addition to ntp, allowing for openntpd.  (Closes: #508258)
   * Add ${misc:Depends} to all dependencies.
+  * Add explanations for the Lintian overrides.
   * Translation updates:
     - Spanish, thanks Francisco Javier Cuadrado.  (Closes: #514452)
 

diff --git a/debian/openafs-client.lintian b/debian/openafs-client.lintian
index 9586880ae036af7dc8f4e92593c193ace2a202b8..ef9985f71809dfc79ed5600d33d6feff2d12cd44 100644 (file)
--- a/debian/openafs-client.lintian
+++ b/debian/openafs-client.lintian
@@ -1 +1,3 @@
-openafs-client: non-standard-dir-perm
+# The AFS client cache should not be world-readable, since it may contain
+# files only readable by some of the local users based on their tokens.
+openafs-client: non-standard-dir-perm /var/cache/openafs/ 0700 != 0755

diff --git a/debian/openafs-dbserver.lintian b/debian/openafs-dbserver.lintian
index 2afb85f5fc6572a39a5740ddd64456b3749132fe..cf65ecb5bbb20ecf7ca1557dbd69d52045496bf8 100644 (file)
--- a/debian/openafs-dbserver.lintian
+++ b/debian/openafs-dbserver.lintian
@@ -1 +1,3 @@
-openafs-dbserver: non-standard-dir-perm
+# The database directory should be kept locked down to prevent reading
+# database information that may not be accessible without authentication.
+openafs-dbserver: non-standard-dir-perm var/lib/openafs/db/ 0700 != 0755

diff --git a/debian/openafs-fileserver.lintian b/debian/openafs-fileserver.lintian
index f2b3998a8557f6471110c68233641219cce23f0f..f77b31f04425299fb3141e591cddcacfe6ee3ba8 100644 (file)
--- a/debian/openafs-fileserver.lintian
+++ b/debian/openafs-fileserver.lintian
@@ -1 +1,3 @@
-openafs-fileserver: non-standard-dir-perm
+# /etc/openafs/server contains the KeyFile for the server, so it's kept
+# locked down as an extra precaution.
+openafs-fileserver: non-standard-dir-perm etc/openafs/server/ 0700 != 0755