Package: pnopaste Version: 1.3-2 Severity: normal Tags: patch
The expired_delete.pl cronjob that is installed by the package is run as user nobody, but debiandb.pm is only accessible by root:www-data. -- System Information: Debian Release: 5.0.4 APT prefers stable APT policy: (800, 'stable'), (500, 'testing'), (200, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 2.6.32-trunk-amd64 (SMP w/2 CPU cores) Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages pnopaste depends on: pn apache2 | httpd <none> (no description available) ii dbconfig-common 1.8.39 common framework for packaging dat ii debconf [debconf-2.0] 1.5.24 Debian configuration management sy ii libgeo-ip-perl 1.31-1+b1 Perl bindings for GeoIP library ii libsyntax-highlight-engine-k 0.05+dfsg-1 port to Perl of the syntax highlig ii perl 5.10.1-12 Larry Wall's Practical Extraction pnopaste recommends no packages. Versions of packages pnopaste suggests: pn pnopaste-cli <none> (no description available) -- debconf information: pnopaste/remote/newhost: pnopaste/internal/reconfiguring: false pnopaste/pgsql/authmethod-user: password pnopaste/missing-db-package-error: abort * pnopaste/dbconfig-install: true pnopaste/mysql/method: unix socket pnopaste/upgrade-backup: true pnopaste/db/basepath: pnopaste/db/app-user: pnopaste pnopaste/install-error: abort pnopaste/internal/skip-preseed: false pnopaste/remove-error: abort pnopaste/pgsql/manualconf: pnopaste/passwords-do-not-match: pnopaste/remote/host: * pnopaste/database-type: mysql pnopaste/pgsql/admin-user: postgres pnopaste/mysql/admin-user: root pnopaste/pgsql/changeconf: false pnopaste/pgsql/authmethod-admin: ident pnopaste/pgsql/no-empty-passwords: pnopaste/purge: false pnopaste/db/dbname: pnopaste pnopaste/remote/port: pnopaste/dbconfig-reinstall: false pnopaste/dbconfig-remove: pnopaste/pgsql/method: unix socket pnopaste/dbconfig-upgrade: true pnopaste/upgrade-error: abort
diff -uNr a/debian/pnopaste.cron.d b/debian/pnopaste.cron.d --- a/debian/pnopaste.cron.d 2010-05-23 14:27:55.000000000 +0200 +++ b/debian/pnopaste.cron.d 2010-05-23 14:27:36.000000000 +0200 @@ -1 +1 @@ -*/30 * * * * nobody if [ -f /usr/share/pnopaste/bin/expired_delete.pl ]; then /usr/bin/perl /usr/share/pnopaste/bin/expired_delete.pl > /dev/null; fi +*/30 * * * * www-data if [ -f /usr/share/pnopaste/bin/expired_delete.pl ]; then /usr/bin/perl /usr/share/pnopaste/bin/expired_delete.pl > /dev/null; fi
