From 74e8166c7d0f8423e527b2e397ffe2f32f750c64 Mon Sep 17 00:00:00 2001 From: Minecrell Date: Sat, 16 Oct 2021 12:36:41 +0200 Subject: [PATCH] main/postmarketos-base: fix file permissions of /etc/sudoers (MR 2610) Installing postmarketos-base currently changes the file permissions of /etc/sudoers: # apk add sudo # stat /etc/sudoers Access: (0440/-r--r-----) Uid: ( 0/ root) Gid: ( 0/ root) # apk add postmarketos-base # stat /etc/sudoers Access: (0044/----r--r--) Uid: ( 0/ root) Gid: ( 0/ root) The file mode 0044 decodes to: - User *cannot* read - Group can read - Other can read which does not make any sense. The "sudoers" man page makes it very clear that this file should have a file mode of 0440 [1] ("readable by owner and group, writable by none"). This looks like a bad typo. However, given that only read permissions were given out this shouldn't have major security implications (except allowing all users to see who can use sudo). Install the file with 0440 instead of 0044 to fix this: # apk add postmarketos-base # stat /etc/sudoers Access: (0440/-r--r-----) Uid: ( 0/ root) Gid: ( 0/ root) [1]: https://www.sudo.ws/man/1.9.8/sudoers.man.html#Error_log_entries --- main/postmarketos-base/APKBUILD | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/main/postmarketos-base/APKBUILD b/main/postmarketos-base/APKBUILD index cecb7dfd6..129952a07 100644 --- a/main/postmarketos-base/APKBUILD +++ b/main/postmarketos-base/APKBUILD @@ -1,6 +1,6 @@ pkgname=postmarketos-base pkgver=15 -pkgrel=0 +pkgrel=1 pkgdesc="Meta package for minimal postmarketOS base" url="https://postmarketos.org" arch="noarch" @@ -29,7 +29,7 @@ replaces=" " replaces_priority=100 # leave plenty for alpine -_source044=" +_source440=" etc/sudoers " _source644=" @@ -59,7 +59,7 @@ flatpath() { done } -source="$(flatpath $_source044 $_source644 $_source755)" +source="$(flatpath $_source440 $_source644 $_source755)" prepare() { default_prepare @@ -70,8 +70,8 @@ prepare() { package() { local i - for i in $_source044; do - install -Dm044 "$srcdir/$(flatpath "$i")" "$pkgdir/$i" + for i in $_source440; do + install -Dm440 "$srcdir/$(flatpath "$i")" "$pkgdir/$i" done for i in $_source644; do install -Dm644 "$srcdir/$(flatpath "$i")" "$pkgdir/$i"