Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
Summary: Review Request: ZoneMinder - Linux CCTV package
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=220931
------- Additional Comments From tibbs(a)math.uh.edu 2007-06-23 16:25 EST -------
BTW, if you have other packages, you should submit them. Sponsorship is always harder to
achieve when you've only provided one packaging sample. Maybe that's one reason
this ticket has been around for so long. But no matter; I'll take care of things
now.
I think an assumption that _datadir will change only rarely is OK and better than having
the absolute symlinks.
I was actually asking whether the application could be patched when I asked if it's
not possible to direct the program to look directly in /var/lib/zm/*
instead of needing symlinks. I guess the fundamental question is whether that data needs
to be directly accessible from a URL. And a related question is whether those directories
need to be restricted in some way.
I just checked my zoneminder installation and I'm rather surprised to see that you can
look in the events directory and see basically everything without logging in at all. Now,
it's possible that my installation is screwed up; I'm using some other packaging
so whatever it does might not be duplicated by this package. But in this package I
don't see anything which would prevent this; FollowSymlinks is explicitly set, as is
Indexes.
So in fact, I think that it's rather critically important that what's in
/var/lib/zm not be visible at all from the web, and so it really shouldn't be present
or reachable from /usr/share/zoneminder/www. This either entails patching the software to
just look in /var/lib/zm directly and to drop the symlinks, or to restrict access to those
directories somehow with .htaccess files or directly in the zoneminder.conf file.
And on the subject of access control, if this package ships with some sort of default
password, the default access controls in zoneminder.conf need to deny all access by
default except that from localhost. Currently just installing this package gives the
world access, and that coupled with default passwords is bad. Usually packages include a
README.Fedora file explaining additional configuration bits like this which need to be
done.
The scriptlets look a bit weird; it's meaningless to have the #! line in them since
they are passed to /bin/sh by default unless you specify another shell with -p. But I
don't really see any issue with adding comments to a scriptlet.
I note that some additional features are enabled when Archive::Tar is installed; as
it's a small module, would it be worth adding it as a dependency?
In summary, I see the access control issues as blockers.
Review:
* source files match upstream:
6bee02be8d5e21d3435c17def157a87727330ee6480be3a8fa5b1966cc10a6bc
ZoneMinder-1.22.3.tar.gz
257d2866fea1dd884810ae00828f32e852568c49cd7ef7560f67fa4f496d1c13
cambozola-0.68.tar.gz
* package meets naming and versioning guidelines.
* specfile is properly named, is cleanly written and uses macros consistently.
* summary is OK.
* description is OK.
* dist tag is present.
* build root is OK.
* license field matches the actual license.
* license is open source-compatible.
* license text included in package.
* latest version is being packaged.
* BuildRequires are proper.
* compiler flags are appropriate.
* %clean is present.
* package builds in mock (development, x86_64).
* package installs properly
* debuginfo package looks complete.
* rpmlint has acceptable complaints.
* final provides and requires are sane:
config(zoneminder) = 1.22.3-3.fc8
perl(ZoneMinder)
perl(ZoneMinder::Base) = 1.22.3
perl(ZoneMinder::Config)
perl(ZoneMinder::ConfigAdmin)
perl(ZoneMinder::Database)
perl(ZoneMinder::Debug)
perl(ZoneMinder::SharedMem)
perl(ZoneMinder::Trigger::Channel)
perl(ZoneMinder::Trigger::Channel::File)
perl(ZoneMinder::Trigger::Channel::Handle)
perl(ZoneMinder::Trigger::Channel::Inet)
perl(ZoneMinder::Trigger::Channel::Serial)
perl(ZoneMinder::Trigger::Channel::Spawning)
perl(ZoneMinder::Trigger::Channel::Unix)
perl(ZoneMinder::Trigger::Connection)
perl(ZoneMinder::Trigger::Connection::Example)
zoneminder = 1.22.3-3.fc8
=
/bin/sh
/sbin/chkconfig
/sbin/service
/usr/bin/perl
config(zoneminder) = 1.22.3-3.fc8
httpd
libcrypto.so.6()(64bit)
libgcc_s.so.1()(64bit)
libgcc_s.so.1(GCC_3.0)(64bit)
libjpeg.so.62()(64bit)
libmysqlclient.so.15()(64bit)
libmysqlclient.so.15(libmysqlclient_15)(64bit)
libpcre.so.0()(64bit)
libstdc++.so.6()(64bit)
libstdc++.so.6(CXXABI_1.3)(64bit)
libstdc++.so.6(GLIBCXX_3.4)(64bit)
libz.so.1()(64bit)
perl >= 0:5.006
perl(Carp)
perl(DBD::mysql)
perl(DBI)
perl(Data::Dumper)
perl(Date::Manip)
perl(Device::SerialPort)
perl(Exporter)
perl(Fcntl)
perl(Getopt::Long)
perl(IO::Handle)
perl(LWP::UserAgent)
perl(POSIX)
perl(Socket)
perl(Storable)
perl(Sys::Syslog)
perl(Time::HiRes)
perl(ZoneMinder)
perl(ZoneMinder::Base)
perl(ZoneMinder::Config)
perl(ZoneMinder::ConfigAdmin)
perl(ZoneMinder::Database)
perl(ZoneMinder::Debug)
perl(ZoneMinder::SharedMem)
perl(ZoneMinder::Trigger::Channel)
perl(ZoneMinder::Trigger::Channel::Handle)
perl(ZoneMinder::Trigger::Channel::Inet)
perl(ZoneMinder::Trigger::Channel::Serial)
perl(ZoneMinder::Trigger::Channel::Spawning)
perl(ZoneMinder::Trigger::Channel::Unix)
perl(ZoneMinder::Trigger::Connection)
perl(bytes)
perl(constant)
perl(strict)
perl(warnings)
* %check is not present; no test suite upstream. I don't have the means to test
this at the moment.
* no shared libraries are added to the regular linker search paths.
* owns the directories it creates.
* doesn't own any directories it shouldn't.
* no duplicates in %files.
* file permissions are appropriate.
* scriptlets are OK (service installation)
* code, not content.
* documentation is small, so no -docs subpackage is necessary.
* %docs are not necessary for the proper functioning of the package.
--
Configure bugmail:
https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug, or are watching the QA contact.