Package: wims
Version: 4.01c-4
Severity: important
Hello Georges,
debian/postinst do:
dpkg-statoverride --update --force --add wims wims 6755
/var/lib/wims/public_html/wims 2>/dev/null 2>&1
...
dpkg-statoverride --update --force --add wims wims 600 $conffile
2>/dev/null
This is incorrect because this override user settings.
Instead you shoud do as policy 10.9.1. recommends:
in the postinst:
if ! dpkg-statoverride --list /var/lib/wims/public_html/wims >/dev/null 2>&1
then
dpkg-statoverride --update --add wims wims 6755
/var/lib/wims/public_html/wims
fi
(the postrm seems correct.)
Fundamentally, it would be nicer to use mod_suexec to start wims with correct
rights that
using setuid/setgid. In particular this would protect against local users
running
/var/lib/wims/public_html/wims manually.
Cheers,
--
Bill. <[email protected]>
Imagine a large red swirl here.
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
