Change /var/lib/openafs/local permissions to 700

* Change the permissions of /var/lib/openafs/local to 0700 to match
  upstream defaults.  This directory contains the fssync.sock file used
  for coordination between the fileserver and the volserver, and
  commands sent to that socket are not authenticated.  Linux protects
  the socket from unprivileged writes by default, but other operating
  systems do not.  Upstream therefore wants this directory to be 0700
  and bosserver will complain by default if it's not.  Changing the
  permissions let us drop a patch to bosserver.

(cherry picked from commit 08427cdedf446993deba85a2a8a99b3fda2f8646)

diff --git a/debian/changelog b/debian/changelog
index 51e82f3fd972fa7dc9cae2297e49ed665d63b96b..3f3014365042cc2f3ce1e81c76cef88af516f37b 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -17,6 +17,14 @@ openafs (1.5.61+dfsg-1) UNRELEASED; urgency=low
     conflicts on pre-1.5.61 openafs-client packages since the interface
     between afsd and the module has changed.  openafs-client now conflicts
     with openafs-modules2 and recommends openafs-modules3.
+  * Change the permissions of /var/lib/openafs/local to 0700 to match
+    upstream defaults.  This directory contains the fssync.sock file used
+    for coordination between the fileserver and the volserver, and
+    commands sent to that socket are not authenticated.  Linux protects
+    the socket from unprivileged writes by default, but other operating
+    systems do not.  Upstream therefore wants this directory to be 0700
+    and bosserver will complain by default if it's not.  Changing the
+    permissions let us drop a patch to bosserver.
   * Fix the second module control file for the standards version, section,
     and maintainer update.
   * Change the source package name of the stripped package generated by

diff --git a/debian/openafs-fileserver.lintian-overrides b/debian/openafs-fileserver.lintian-overrides
index f77b31f04425299fb3141e591cddcacfe6ee3ba8..dfcbf3c2dab2bcbf5095c17ac0771d0d27b2ed0c 100644 (file)
--- a/debian/openafs-fileserver.lintian-overrides
+++ b/debian/openafs-fileserver.lintian-overrides
@@ -1,3 +1,9 @@
 # /etc/openafs/server contains the KeyFile for the server, so it's kept
 # locked down as an extra precaution.
 openafs-fileserver: non-standard-dir-perm etc/openafs/server/ 0700 != 0755
+
+# /var/lib/openafs/local contains the fssync.sock file used to coordinate
+# volume actions between the fileserver and the volserver so upstream
+# wants it to be locked down.  Probably doesn't matter on Linux, but if we
+# diverge, we either have to patch bosserver or it complains.
+openafs-fileserver: non-standard-dir-perm var/lib/openafs/local/ 0700 != 0755

diff --git a/debian/openafs-fileserver.postinst b/debian/openafs-fileserver.postinst
index 85319150e9a9c82de8485397d441d4b19a6a6bb2..3c546b227b4e67c6502e18b31d663ba74aafcba1 100644 (file)
--- a/debian/openafs-fileserver.postinst
+++ b/debian/openafs-fileserver.postinst
@@ -37,6 +37,15 @@ configure)
         fi
     fi
     db_stop
+
+    # Previous versions of the package set the permissions on
+    # /var/lib/openafs/local to 755, but upstream prefers 700 to protect the
+    # fssync.sock socket.  Probably doesn't matter on Linux, but if we
+    # diverge, either bosserver complains or we have to patch it.  dpkg won't
+    # change the permissions of existing directories.
+    if [ x"$2" != x ] && dpkg --compare-versions "$2" lt 1.4.11+dfsg-3 ; then
+        chmod 700 /var/lib/openafs/local
+    fi
     ;;
 
 abort-upgrade|abort-remove|abort-deconfigure)

diff --git a/debian/rules b/debian/rules
index 849425ab12146250efe38407b6424b29a28507df..3c8d0e9a46887f7bd1c68c6052bb6db7276e6ad3 100755 (executable)
--- a/debian/rules
+++ b/debian/rules
@@ -210,6 +210,7 @@ install-stamp: build-stamp
        chmod 700 debian/openafs-client/var/cache/openafs
        chmod 700 debian/openafs-dbserver/var/lib/openafs/db
        chmod 700 debian/openafs-fileserver/etc/openafs/server
+       chmod 700 debian/openafs-fileserver/var/lib/openafs/local
        touch $@
 
 binary-indep: install-stamp