On 03/02/2012 03:46 AM, Corinna Vinschen wrote:
> On Mar 1 11:08, Corinna Vinschen wrote:
>> # Fix a problem introduced by older versions of setup.exe
>> [...]
>
> David, ping? Can we add the below two files to base-files asap and
> remove the tmp/temp workaround, please?
>
> /etc/profile.d/1777fix.csh:
>
> #!/bin/tcsh
> # Fix a problem introduced by older versions of setup.exe
> # Read comments in /etc/profile.d/1777fix.sh for more information.
> set GUARDFILE = "/etc/.1777fix"
> if ( ! -f "${GUARDFILE}" ) then
> /bin/bash /etc/profile.d/1777fix.sh
> endif
>
> /etc/profile.d/1777fix.sh:
>
> #!/bin/bash
As long as we're requiring bash,...
> # Fix a problem introduced by older versions of setup.exe
> # Directories with 1777 permissions were erroneously created
> # with 777 inheritable default permissions. This is a security
> # problem for non-Cygwin apps using these folders. This is
> # especially tragic in case of /tmp.
> GUARDFILE="/etc/.1777fix"
> DIRLIST="/home /tmp /usr/tmp /var/log /var/run"
> if [ ! -f "${GUARDFILE}" ]
> then
> cnt=0
> success=0
> for file in ${DIRLIST}
> do
> # We test if the default group or other permissions are rwx.
> # If so, it's dangerous and highly likely that these are still
> # the permissions set by setup.exe
> if getfacl "${file}" | grep -Eq 'default:(group:|other):rwx'
Is it worth converting this to case/esac for one fewer child process?
> then
> cnt=$(expr $cnt + 1)
...this should be written cnt=$((cnt + 1))
> setfacl -m d:g::r-x,d:o:r-x "${file}" 2>/dev/null \
> && success=$(expr $success + 1)
and this as success=$((success + 1))
> fi
> done
> # If no file needed treatment, or if all setfacl calls succeeded,
> # create the
Incomplete comment.
> [ $cnt -eq $success ] && touch "${GUARDFILE}"
> fi
>
>
> Thanks,
> Corinna
>
--
Eric Blake ebl...@redhat.com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
signature.asc
Description: OpenPGP digital signature
