On Wed, Nov 19, 2014 at 10:37:25AM +0100, Lukas Slebodnik wrote:
On (30/10/14 11:25), Pavel Reichl wrote:
>Hello,
>
>please see attached patch.
>
>Thanks!
>From 6d364e9468ea5c3ad0913853e1fb62112441e6a2 Mon Sep 17 00:00:00 2001
>From: Pavel Reichl <preichl(a)redhat.com>
>Date: Thu, 30 Oct 2014 10:13:54 +0000
>Subject: [PATCH] BUILD: restrict perms. when installing from source
>
>Resolves:
>https://fedorahosted.org/sssd/ticket/2467
>---
> Makefile.am | 19 +++++++++----------
> 1 file changed, 9 insertions(+), 10 deletions(-)
>
>diff --git a/Makefile.am b/Makefile.am
>index
61bf5cf957d4024b67f48cf42f5735b5fa368945..f273d881699002ba6698e3de787648f9bd1cf68d 100644
>--- a/Makefile.am
>+++ b/Makefile.am
>@@ -2759,16 +2759,15 @@ installsssddirs::
> $(DESTDIR)$(sudolibdir) \
> $(DESTDIR)$(autofslibdir) \
> $(NULL); \
>- $(INSTALL) $(INSTALL_USER_DIR_FLAGS) \
>- $(DESTDIR)$(dbpath) \
>- $(DESTDIR)$(mcpath) \
>- $(DESTDIR)$(pipepath) \
>- $(DESTDIR)$(pipepath)/private \
>- $(DESTDIR)$(pubconfpath) \
>- $(DESTDIR)$(pubconfpath)/krb5.include.d \
>- $(DESTDIR)$(gpocachepath) \
>- $(DESTDIR)$(sssdconfdir) \
>- $(DESTDIR)$(logpath) \
>+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0700 $(DESTDIR)$(dbpath); \
>+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0755 $(DESTDIR)$(mcpath); \
>+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0755 $(DESTDIR)$(pipepath); \
>+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0700 $(DESTDIR)$(pipepath)/private; \
>+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0755 $(DESTDIR)$(pubconfpath); \
>+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0755
$(DESTDIR)$(pubconfpath)/krb5.include.d; \
>+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0755 $(DESTDIR)$(gpocachepath); \
^^
horizontal tab is used instead of spaces. We have a convetion that just first
command in series ("com1; com2; ...").
I would prefer to remove wrapping of new line at the end.
>+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0600 $(DESTDIR)$(sssdconfdir); \
>+ $(INSTALL) $(INSTALL_USER_DIR_FLAGS) -m 0600 $(DESTDIR)$(logpath) \
^^^^
Why sssd user cannot change dir to $(logpath)?
It would be difficult to analyze log files from parent directory.
LS
btw after the recent changes to build system I don't thik this patch
applies anymore.