On (30/10/14 11:25), Pavel Reichl wrote:
Hello,
please see attached patch.
Thanks!
From 6d364e9468ea5c3ad0913853e1fb62112441e6a2 Mon Sep 17 00:00:00
2001
From: Pavel Reichl <preichl(a)redhat.com>
Date: Thu, 30 Oct 2014 10:13:54 +0000
Subject: [PATCH] BUILD: restrict perms. when installing from source
Resolves:
https://fedorahosted.org/sssd/ticket/2467
---
Makefile.am | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
diff --git a/Makefile.am b/Makefile.am
index 61bf5cf957d4024b67f48cf42f5735b5fa368945..f273d881699002ba6698e3de787648f9bd1cf68d
100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -2759,16 +2759,15 @@ installsssddirs::
$(DESTDIR)$(sudolibdir) \
$(DESTDIR)$(autofslibdir) \
$(NULL); \
- $(INSTALL) $(INSTALL_USER_DIR_FLAGS) \
- $(DESTDIR)$(dbpath) \
- $(DESTDIR)$(mcpath) \
- $(DESTDIR)$(pipepath) \
- $(DESTDIR)$(pipepath)/private \
- $(DESTDIR)$(pubconfpath) \
- $(DESTDIR)$(pubconfpath)/krb5.include.d \
- $(DESTDIR)$(gpocachepath) \
- $(DESTDIR)$(sssdconfdir) \
- $(DESTDIR)$(logpath) \
+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0700 $(DESTDIR)$(dbpath); \
+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0755 $(DESTDIR)$(mcpath); \
+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0755 $(DESTDIR)$(pipepath); \
+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0700 $(DESTDIR)$(pipepath)/private; \
+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0755 $(DESTDIR)$(pubconfpath); \
+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0755 $(DESTDIR)$(pubconfpath)/krb5.include.d; \
+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0755 $(DESTDIR)$(gpocachepath); \
^^
horizontal tab is used instead of spaces. We have a convetion that just first
command in series ("com1; com2; ...").
I would prefer to remove wrapping of new line at the end.
+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0600
$(DESTDIR)$(sssdconfdir); \
+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0600 $(DESTDIR)$(logpath) \
^^^^
Why sssd user cannot change dir to $(logpath)?
It would be difficult to analyze log files from parent directory.
LS