Bug 44397

Summary:	Incorrect permissions (write/execute) when installing POPFile
Product:	Gentoo Linux	Reporter:	repugnant <bugreporter>
Component:	New packages	Assignee:	Stuart Herbert (RETIRED) <stuart>
Status:	VERIFIED TEST-REQUEST
Severity:	major
Priority:	High
Version:	1.4
Hardware:	x86
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description repugnant 2004-03-11 15:24:48 UTC

After emerging net-mail/popfile-0.21.1 I had trouble running it (including a missing dependency - see bug 44394).  But there are other problems.  The files installed to /usr/share/popfile/ are *world* writeable, which probably represents a security risk.  I think someone could change the modules. I rated this a "Major" bug because I'm not 100% sure of the security problems.

Reproducible: Didn't try
Steps to Reproduce:
1. emerge popfile
2. check out the permissions in /usr/share/popfile/*

Actual Results:  
Most files were user, group, and other writeable

Expected Results:  
Only root should be able to write I guess.

Comment 1 Stuart Herbert (RETIRED) gentoo-dev

2004-03-17 11:08:06 UTC

Updated the ebuild in portage; it should be appearing on a local rsync mirror in about an hour or so.

Comment 2 Stuart Herbert (RETIRED) gentoo-dev

2004-03-27 16:05:51 UTC

Closing bug - no feedback from submitter

Comment 3 repugnant 2004-03-27 16:16:06 UTC

I'm sorry for not responding; I didn't realize that I was supposed to try it out, since I had fixed the problem manually myself.  I will pay more attention next time I submit a bug.  Thanks for fixing it :)