Bug 182998 - sys-process/cronbase insecure permissions because of portage behaviour
|
Bug#:
182998
|
Product: Gentoo Security
|
Version: unspecified
|
Platform: All
|
|
OS/Version: Linux
|
Status: RESOLVED
|
Severity: minor
|
Priority: P2
|
|
Resolution: FIXED
|
Assigned To: security@gentoo.org
|
Reported By: jakub@gentoo.org
|
|
Component: Vulnerabilities
|
|
|
URL:
|
|
Summary: sys-process/cronbase insecure permissions because of portage behaviour
|
|
Keywords:
|
|
Status Whiteboard: A4? [noglsa]
|
|
Opened: 2007-06-23 18:30 0000
|
OK, this is how it *should* look like per sys-process/cronbase ebuild:
drwxr-x--- 2 root root 216 2007-06-13 17:11 /etc/cron.daily
drwxr-x--- 2 root root 72 2006-03-08 22:05 /etc/cron.hourly
drwxr-x--- 2 root root 136 2007-06-22 22:51 /etc/cron.monthly
drwxr-x--- 2 root root 72 2007-01-06 13:01 /etc/cron.weekly
drwxr-x--- 4 root cron 120 2006-03-08 22:06 /var/spool/cron
drwxr-x--- 2 root root 200 2007-06-23 20:10 /var/spool/cron/lastrun
Except that portage does *not* change actual directory permissions if the
directory already exists (see Bug 141619). A quick poll on #gentoo-dev shows
that almost *noone* has the permissions right, most usually they are 0755
root:root, a couple of cases of /var/spool/cron owned by cron user, etc. etc.
Also see Bug 182983.
Suggested solution: revbump sys-process/cronbase and force chown/chmod in
pkg_postinst, which works around portage behaviour.
cron, what's the status here? please advise.
cronbase ebuild activity is rather low. I did the last revbump of vixie-cron
and i can take care of cronbase too. (then i should join the cron herd)
Just ping me again if noone of the cron herd wakes up.
(In reply to comment #2)
> cronbase ebuild activity is rather low. I did the last revbump of vixie-cron
> and i can take care of cronbase too. (then i should join the cron herd)
>
> Just ping me again if noone of the cron herd wakes up.
>
*ping* :)
Hi arches,
cronbase-0.3.2-r1 commited to the tree.
After having emerged it, your system should be as described in comment #0.
Please test, and mark stable if appropriate, thanks.
(In reply to comment #4)
> After having emerged it, your system should be as described in comment #0.
*Mainly* that's happened. The only difference is uid/gid bit:
drwxr-s--- 2 root cron 4096 wrz 27 00:58 /var/spool/cron/lastrun
Sparc done. It sets ownership/permissions the way bug says it's supposed to.
If this stays at A4, it needs a vote.
Hmm, this is local, minor impact, so I vote NO.
only information disclosure. No big impact. No and closing. Feel free to reopen
if you disagree
