Bug 708080 – games-puzzle/bastet - bastet: using a user-specific high scores file: /home/{user}/.bastetscores as the global high scores file /var/games/bastet.scores2 is not writable

• Status: UNCONFIRMED
• Product: Gentoo Linux

[Description Brandon Sakai 2020-02-03 19:36:19 UTC]

games-puzzle/bastet's ebuild runs the following commands in its src_install()

        touch "${ED}/var/games/bastet.scores" || die "touch failed"
        fperms 664 /var/games/bastet.scores

When running bastet, the following error appears

        bastet: using a user-specific high scores file: /home/{user}/.bastetscores
        as the global high scores file /var/games/bastet.scores2 is not writable

This is because the ebuild creates /var/games/bastet.scores rather than /var/games/bastet.scores2. This is easily fixed by changing bastet.scores to bastet.scores2 in the ebuild.


Additionally, /var/games/bastet.scores has mode 

        -rw-rw-r-- 1 root root     1021 Feb  3 14:14 bastet.scores

so it isn't user writeable. This could be fixed by changing the fperms line to 666 rather than 664 so that bastet could write high scores to the world high score list. Alternatively, it could be 664 but with group gamestat so users in the gamestat group can write to it (see acct-group/gamestat).

The recommended setup is shown here https://github.com/fph/bastet/blob/5037e410fde6fafe8e6bc4cf17a12ad98e01c17e/INSTALL

[Comment 1 Jeroen Roovers (RETIRED) 2020-02-03 20:06:44 UTC]

(In reply to Brandon Sakai from comment #0)
> games-puzzle/bastet's ebuild runs the following commands in its src_install()
> 
>         touch "${ED}/var/games/bastet.scores" || die "touch failed"
>         fperms 664 /var/games/bastet.scores

It does that? Looks like a security bug.

[Comment 2 Brandon Sakai 2020-02-03 20:25:11 UTC]

Created attachment 611498 [details, diff]
Simple ebuild patch

This is a quick patch I threw together using games-action/moon-buggy as a guide. I'm not sure what the security issue you see is so I'm not sure if this fixes it or if moon-buggy just also has it.