On Wednesday 25 of February 2015 17:29:11 Bastien Nocera wrote:
abrt-dbus already allows users to list problems, and will make sure
of filtering out problems that the user is not allowed to interact with.
To avoid users knowing that particular problems are being created for
another user, make sure that /var/tmp/abrt is not listable.
---
abrt.spec.in | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/abrt.spec.in b/abrt.spec.in
index 53d3308..d52e66b 100644
--- a/abrt.spec.in
+++ b/abrt.spec.in
@@ -728,7 +728,7 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor
&>/dev/null || : %{_mandir}/man5/abrt_event.conf.5.gz
%config(noreplace) %{_sysconfdir}/libreport/events.d/smart_event.conf
%{_mandir}/man5/smart_event.conf.5.gz
-%dir %attr(0755, abrt, abrt) %{_localstatedir}/%{var_base_dir}/%{name}
+%dir %attr(0750, abrt, abrt) %{_localstatedir}/%{var_base_dir}/%{name}
%dir %attr(0700, abrt, abrt) %{_localstatedir}/spool/%{name}-upload
# abrtd runs as root
%dir %attr(0755, root, root) %{_localstatedir}/run/%{name}
Pushed. Thanks!
https://github.com/abrt/abrt/commit/61f3b160f609c112728e6cf3c55076aeabb75319
https://github.com/abrt/abrt/commit/a2933a10cd5e5e796ace5403ea8b6144ea7e7660