The new ebuild for partimaged sets some permissions on ebuild config incorrectly. The partimaged.cert must have 0600 permissions, and be owned by at least partimag:root, as with the partimaged.key file.
partimaged.cert contains NOTHING private, therefore does not need to be 0600. i don't want partimaged to be able to change it's cert, so owned by root:root is correct.
I a not questioning your motives but am rather questioning what works. Below is all combinations of 600 644 root:root partimag:root... At first it it 644 and partimag:root, then 644 with root:root, then 600 with root:root and finally, 600 with partimag:root : confucius partimaged # ls -l partimaged.cert -rw------- 1 partimag root 3498 Apr 26 13:31 partimaged.cert confucius partimaged # chmod 644 partimaged.cert confucius partimaged # partimaged error when verifying /etc/partimaged/partimaged.cert, check logfile for help logfile is /var/log/partimaged.log if you don't have logfile, use partimaged --debug=1 confucius partimaged # chown root:root partimaged.cert confucius partimaged # partimaged error when verifying /etc/partimaged/partimaged.cert, check logfile for help logfile is /var/log/partimaged.log if you don't have logfile, use partimaged --debug=1 confucius partimaged # chmod 600 partimaged.cert confucius partimaged # partimaged 27351:error:0200100D:system library:fopen:Permission denied:bss_file.c:276:fopen('/etc/partimaged/partimaged.cert','r') 27351:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:278: 27351:error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib:ssl_rsa.c:515: confucius partimaged # chown partimag:root partimaged.cert confucius partimaged # partimaged <- Now it runs
looking at upstream's code, it's a definate bug in their work. i'll look at a fix.
ok, i've disabled partimage's stupid checks for permissions. it doesn't need them as they are, and it's more secure with it properly configured by the ebuild. should a hole ever be found, we'll be better protected. and i tested it this time as well, with the user login and SSL functionality and it works 100%.
