Bug 682898 – games-puzzle/ltris-1.0.19-r1 : QA Security Notice: world writable file(s):

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Toralf Förster 2019-04-08 18:00:55 UTC]

QA: other
QA Security Notice: world writable file(s):
  /var/lib/ltris.hscr
This may or may not be a security problem, most of the time it is one.
Please double check that ltris-1.0.19-r1 really needs a world writeable bit and file bugs accordingly.


  -------------------------------------------------------------------

  This is an unstable amd64 chroot image at a tinderbox (==build bot)
  name: 17.1_libressl_20190405-161922

  -------------------------------------------------------------------

[Comment 1 Toralf Förster 2019-04-08 18:00:58 UTC]

Created attachment 572268 [details]
etc.portage.tbz2

[Comment 2 Toralf Förster 2019-04-08 18:01:00 UTC]

Created attachment 572270 [details]
games-puzzle:ltris-1.0.19-r1:20190408-010333.log

[Comment 3 Ulrich Müller 2023-05-23 07:14:50 UTC]

Assuming this is a highscore file, it should live in /var/lib/ltris.hscr:

https://projects.gentoo.org/qa/policy-guide/filesystem.html#pg0205
"If games need privileged access to shared files, the group gamestat can be used for this purpose. The game executables should be owned by that group and made setgid. The shared files must be installed into /var/games hierarchy, and writable to gamestat group."

[Comment 4 Larry the Git Cow 2023-05-23 08:14:17 UTC]

The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fe39371f860060a5b540dddd2900e8297b562308

commit fe39371f860060a5b540dddd2900e8297b562308
Author:     Ulrich Müller <[e-mail]>
AuthorDate: 2023-05-23 07:05:50 +0000
Commit:     Ulrich Müller <[e-mail]>
CommitDate: 2023-05-23 07:58:36 +0000

    games-puzzle/ltris: Install highscore file in /var/games
    
    Update to EAPI 8.
    
    Closes: https://bugs.gentoo.org/682898
    Signed-off-by: Ulrich Müller <[e-mail]>

 ...ris-1.0.19-r1.ebuild => ltris-1.0.19-r2.ebuild} | 23 ++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)