[patch] wine-1.3.21.ebuild.patch

wine-1.3.21.ebuild.patch (text/plain), 1.21 KB, created by Andrew Savchenko on 2011-05-29 17:45:16 UTC

--- wine-1.3.21.ebuild.orig	2011-05-28 21:53:09.000000000 +0400
+++ wine-1.3.21.ebuild	2011-05-29 21:12:18.698365238 +0400
@@ -100,6 +100,10 @@
 	sys-devel/bison
 	sys-devel/flex"
 
+pkg_setup() {
+	enewgroup wine
+}
+
 src_unpack() {
 	if use win64 ; then
 		[[ $(( $(gcc-major-version) * 100 + $(gcc-minor-version) )) -lt 404 ]] \
@@ -209,8 +213,19 @@
 	if ! use perl ; then
 		rm "${D}"/usr/bin/{wine{dump,maker},function_grep.pl} "${D}"/usr/share/man/man1/wine{dump,maker}.1 || die
 	fi
+
+	# for all bins and libs disable world access and group write access
+	# only users from wine group may be able to use it
+	local filelist=$( find "${D}"/usr/{bin,lib} -type f | gawk -v path="${D}" '{ gsub("^"path,""); print $0 }')
+	fowners :wine ${filelist} || die "chown failed"
+	fperms -R o-rwx,g-w ${filelist} || die "chmod failed"
 }
 
 pkg_postinst() {
 	paxctl -psmr "${ROOT}"/usr/bin/wine{,-preloader} 2>/dev/null #255055
+
+	ewarn "You must be in the wine group in order to be able to use wine."
+	ewarn "It is recommended to use a separate user for running wine in order"
+	ewarn "to improve security by isolation. See Risks section in the wine FAQ:"
+	ewarn "http://wiki.winehq.org/FAQ#head-3cb8f054b33a63be30f98a1b6225d74e305a0459"
 }