From 8e1a45e313b69d64acddb5f31a05e072690ee673 Mon Sep 17 00:00:00 2001 From: Russ Allbery Date: Sat, 22 Aug 2009 12:17:45 -0700 Subject: [PATCH] Change /var/lib/openafs/local permissions to 700 * Change the permissions of /var/lib/openafs/local to 0700 to match upstream defaults. This directory contains the fssync.sock file used for coordination between the fileserver and the volserver, and commands sent to that socket are not authenticated. Linux protects the socket from unprivileged writes by default, but other operating systems do not. Upstream therefore wants this directory to be 0700 and bosserver will complain by default if it's not. Changing the permissions let us drop a patch to bosserver. (cherry picked from commit 08427cdedf446993deba85a2a8a99b3fda2f8646) --- debian/changelog | 8 ++++++++ debian/openafs-fileserver.lintian-overrides | 6 ++++++ debian/openafs-fileserver.postinst | 9 +++++++++ debian/rules | 1 + 4 files changed, 24 insertions(+) diff --git a/debian/changelog b/debian/changelog index 51e82f3fd..3f3014365 100644 --- a/debian/changelog +++ b/debian/changelog @@ -17,6 +17,14 @@ openafs (1.5.61+dfsg-1) UNRELEASED; urgency=low conflicts on pre-1.5.61 openafs-client packages since the interface between afsd and the module has changed. openafs-client now conflicts with openafs-modules2 and recommends openafs-modules3. + * Change the permissions of /var/lib/openafs/local to 0700 to match + upstream defaults. This directory contains the fssync.sock file used + for coordination between the fileserver and the volserver, and + commands sent to that socket are not authenticated. Linux protects + the socket from unprivileged writes by default, but other operating + systems do not. Upstream therefore wants this directory to be 0700 + and bosserver will complain by default if it's not. Changing the + permissions let us drop a patch to bosserver. * Fix the second module control file for the standards version, section, and maintainer update. * Change the source package name of the stripped package generated by diff --git a/debian/openafs-fileserver.lintian-overrides b/debian/openafs-fileserver.lintian-overrides index f77b31f04..dfcbf3c2d 100644 --- a/debian/openafs-fileserver.lintian-overrides +++ b/debian/openafs-fileserver.lintian-overrides @@ -1,3 +1,9 @@ # /etc/openafs/server contains the KeyFile for the server, so it's kept # locked down as an extra precaution. openafs-fileserver: non-standard-dir-perm etc/openafs/server/ 0700 != 0755 + +# /var/lib/openafs/local contains the fssync.sock file used to coordinate +# volume actions between the fileserver and the volserver so upstream +# wants it to be locked down. Probably doesn't matter on Linux, but if we +# diverge, we either have to patch bosserver or it complains. +openafs-fileserver: non-standard-dir-perm var/lib/openafs/local/ 0700 != 0755 diff --git a/debian/openafs-fileserver.postinst b/debian/openafs-fileserver.postinst index 85319150e..3c546b227 100644 --- a/debian/openafs-fileserver.postinst +++ b/debian/openafs-fileserver.postinst @@ -37,6 +37,15 @@ configure) fi fi db_stop + + # Previous versions of the package set the permissions on + # /var/lib/openafs/local to 755, but upstream prefers 700 to protect the + # fssync.sock socket. Probably doesn't matter on Linux, but if we + # diverge, either bosserver complains or we have to patch it. dpkg won't + # change the permissions of existing directories. + if [ x"$2" != x ] && dpkg --compare-versions "$2" lt 1.4.11+dfsg-3 ; then + chmod 700 /var/lib/openafs/local + fi ;; abort-upgrade|abort-remove|abort-deconfigure) diff --git a/debian/rules b/debian/rules index 849425ab1..3c8d0e9a4 100755 --- a/debian/rules +++ b/debian/rules @@ -210,6 +210,7 @@ install-stamp: build-stamp chmod 700 debian/openafs-client/var/cache/openafs chmod 700 debian/openafs-dbserver/var/lib/openafs/db chmod 700 debian/openafs-fileserver/etc/openafs/server + chmod 700 debian/openafs-fileserver/var/lib/openafs/local touch $@ binary-indep: install-stamp -- 2.39.5