rpm/permissions
SHA256
1
0
Fork 0
forked from pool/permissions
Code Pull Requests Activity

OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/permissions?expand=0&rev=4

Browse Source
This commit is contained in:
OBS User unknown 2007-02-25 22:35:05 +00:00 committed by Git OBS Bridge
parent 3ecf080911
commit da6d625044
6 changed files with 97 additions and 92 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

129
SuSEconfig.permissions
View File

@ -1,81 +1,86 @@
#! /bin/sh #! /bin/bash
# Copyright (c) 2000-2002 SuSE Linux AG, Nuernberg, Germany. # This module checks and sets file permissions
# All rights reserved. # Copyright (C) 1996-2007 SUSE Linux Products GmbH, Nuernberg, Germany.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
# #
# Author: Burchard Steinbild, 1996-97 # Author: Burchard Steinbild, 1996-97
# Bernhard Kaindl <bk@suse.de>, 1999 # Bernhard Kaindl <bk@suse.de>, 1999
# Rüdiger Oertel <ro@suse.de>, 2000-01 # Rüdiger Oertel <ro@suse.de>, 2000-01
# Ludwig Nussel <lnussel@suse.de> 2007
# #
# This module checks and sets file permissions
# check if we are started as root . /lib/YaST/SuSEconfig.functions || exit 1
# only one of UID and USER must be set correctly
if test "$UID" != 0 -a "$USER" != root; then
echo "You must be root to start $0."
exit 1
fi
r=$ROOT for i in /etc/sysconfig/security /etc/sysconfig/suseconfig ; do
. $i || exit 1
test -f $r/lib/YaST/SuSEconfig.functions || {
echo "ERROR - can not find $r/lib/YaST/SuSEconfig.functions!!"
echo "This should not happen. Exit..."
exit 1
}
. $r/lib/YaST/SuSEconfig.functions
for i in $r/etc/sysconfig/security $r/etc/sysconfig/suseconfig ; do
if test ! -f $i ; then
echo "No $i found."
exit 1
fi
. $i
done done
if test -n "$ENABLE_SUSECONFIG" -a "$ENABLE_SUSECONFIG" = "no" ; then if test -n "$ENABLE_SUSECONFIG" -a "$ENABLE_SUSECONFIG" = "no" ; then
echo "SuSEconfig is disabled in $r/etc/sysconfig/suseconfig." echo "SuSEconfig is disabled in /etc/sysconfig/suseconfig"
echo "Exit..."
exit 0 exit 0
fi fi
test -z "$r" -a ! -e $r/usr/lib/YaST/.DemoMode || exit 0 mode=""
case "$CHECK_PERMISSIONS" in
set) mode="-set" ;;
warn) ;;
no|"") exit 0 ;;
*) echo "invalid value '$CHECK_PERMISSIONS' for \$CHECK_PERMISSIONS" >&2 ;;
esac
if test -n "$CHECK_PERMISSIONS" -a \
-x /usr/bin/chkstat ; then
PERMISSIONS_FILES=""
PACKAGE_PERMFILES=(/etc/permissions.d/*) # collect files that contain permission specifications
PACKAGE_PERMFILES=(${PACKAGE_PERMFILES[*]##*/}) #
PACKAGE_PERMFILES=(${PACKAGE_PERMFILES[*]%%\.*}) # 1. central fixed permissions file
PACKS=${PACKAGE_PERMFILES[*]} files="/etc/permissions"
if test -n "$PACKS" ; then
test -x /usr/bin/sort && { # 2. central easy, secure paranoid as those are defined by SUSE
PACKS=`for j in $PACKS ; do echo $j ; done | /usr/bin/sort -u` for level in $PERMISSION_SECURITY; do
} case "$level" in
for i in $PACKS ; do easy|secure|paranoid)
test -e /etc/permissions.d/$i && \ if [ -e /etc/permissions.$level ]; then
PERMISSIONS_FILES="$PERMISSIONS_FILES /etc/permissions.d/$i" files="$files /etc/permissions.$level"
for PERMEXT in $PERMISSION_SECURITY ; do
test -e /etc/permissions.d/$i.$PERMEXT && \
PERMISSIONS_FILES="$PERMISSIONS_FILES /etc/permissions.d/$i.$PERMEXT"
done
done
fi fi
;;
test -e /etc/permissions && \ esac
PERMISSIONS_FILES="$PERMISSIONS_FILES /etc/permissions"
for PERMEXT in $PERMISSION_SECURITY ; do
test -e /etc/permissions.$PERMEXT && \
PERMISSIONS_FILES="$PERMISSIONS_FILES /etc/permissions.$PERMEXT"
done done
if test "$CHECK_PERMISSIONS" = "set" ; then # 3. package specific permissions
/usr/bin/chkstat -set $PERMISSIONS_FILES pkgfiles=(/etc/permissions.d/*)
elif test "$CHECK_PERMISSIONS" = "warn" ; then pkgfiles=(${pkgfiles[*]##*/})
/usr/bin/chkstat $PERMISSIONS_FILES pkgfiles=(${pkgfiles[*]%%.*})
pkgfiles=(`for i in ${pkgfiles[@]}; do echo $i; done | /usr/bin/sort -u`)
for file in ${pkgfiles[@]}; do
file=/etc/permissions.d/$file
[ -e $file ] && files="$files $file"
for level in $PERMISSION_SECURITY; do
[ -e $file.$level ] && files="$files $file.$level"
done
done
# 4. central permissions files with user defined level incl 'local'
for level in $PERMISSION_SECURITY; do
case "$level" in
easy|secure|paranoid) continue ;;
esac
if [ -e /etc/permissions.$level ]; then
files="$files /etc/permissions.$level"
fi fi
done
fi /usr/bin/chkstat $mode $files

12
permissions.changes
View File

@ -1,3 +1,15 @@
-------------------------------------------------------------------
Thu Feb 22 17:50:27 CET 2007 - lnussel@suse.de
- prefer package specific permissions files over central ones
(#246252)
-------------------------------------------------------------------
Thu Feb 22 16:51:06 CET 2007 - lnussel@suse.de
- add /opt/kde3/bin/start_kdeinit (#203535)
- remove entries for dropped packages OpenPBS and xtetris
------------------------------------------------------------------- -------------------------------------------------------------------
Wed Jan 17 13:53:28 CET 2007 - lnussel@suse.de Wed Jan 17 13:53:28 CET 2007 - lnussel@suse.de

12
permissions.easy
View File

@ -208,12 +208,6 @@
/usr/bin/rlogin root:root 4755 /usr/bin/rlogin root:root 4755
/usr/bin/rsh root:root 4755 /usr/bin/rsh root:root 4755
# OpenPBS #66320
/var/spool/pbs/spool root:root 1777
/var/spool/pbs/undelivered root:root 1777
/opt/pbs/sbin/pbs_iff root:root 4755
/opt/pbs/sbin/pbs_rcp root:root 4755
# heartbeat #66310 # heartbeat #66310
# cl_status needs to be allowed to connect to the heartbeat API. If the setgid # cl_status needs to be allowed to connect to the heartbeat API. If the setgid
# bit is removed, one can manually add users to the haclient group instead. # bit is removed, one can manually add users to the haclient group instead.
@ -269,6 +263,9 @@
/opt/kde3/bin/kdesud root:nogroup 2755 /opt/kde3/bin/kdesud root:nogroup 2755
# used for getting proxy settings from dhcp # used for getting proxy settings from dhcp
/opt/kde3/bin/kpac_dhcp_helper root:root 4755 /opt/kde3/bin/kpac_dhcp_helper root:root 4755
# used to distract the oom killer
# #203535
/opt/kde3/bin/start_kdeinit root:root 4755
# edits /etc/smb.conf # edits /etc/smb.conf
# #66312 # #66312
/usr/bin/fileshareset root:root 4755 /usr/bin/fileshareset root:root 4755
@ -390,9 +387,6 @@
# xgalaga # xgalaga
/usr/bin/xgalaga games:games 2755 /usr/bin/xgalaga games:games 2755
# xtetris
/usr/bin/xtetris games:games 2755
# rocksndiamonds # rocksndiamonds
/usr/games/rocksndiamonds games:games 2755 /usr/games/rocksndiamonds games:games 2755

12
permissions.paranoid
View File

@ -224,12 +224,6 @@
/usr/bin/rlogin root:root 0755 /usr/bin/rlogin root:root 0755
/usr/bin/rsh root:root 0755 /usr/bin/rsh root:root 0755
# OpenPBS #66320
/var/spool/pbs/spool root:root 0755
/var/spool/pbs/undelivered root:root 0755
/opt/pbs/sbin/pbs_iff root:root 0755
/opt/pbs/sbin/pbs_rcp root:root 0755
# heartbeat #66310 # heartbeat #66310
# cl_status needs to be allowed to connect to the heartbeat API. If the setgid # cl_status needs to be allowed to connect to the heartbeat API. If the setgid
# bit is removed, one can manually add users to the haclient group instead. # bit is removed, one can manually add users to the haclient group instead.
@ -282,6 +276,9 @@
/opt/kde3/bin/kdesud root:nogroup 0755 /opt/kde3/bin/kdesud root:nogroup 0755
# used for getting proxy settings from dhcp # used for getting proxy settings from dhcp
/opt/kde3/bin/kpac_dhcp_helper root:root 0755 /opt/kde3/bin/kpac_dhcp_helper root:root 0755
# used to distract the oom killer
# #203535
/opt/kde3/bin/start_kdeinit root:root 0755
# edits /etc/smb.conf # edits /etc/smb.conf
# #66312 # #66312
/usr/bin/fileshareset root:root 0755 /usr/bin/fileshareset root:root 0755
@ -407,9 +404,6 @@
# xgalaga # xgalaga
/usr/bin/xgalaga games:games 0755 /usr/bin/xgalaga games:games 0755
# xtetris
/usr/bin/xtetris games:games 0755
# rocksndiamonds # rocksndiamonds
/usr/games/rocksndiamonds games:games 0755 /usr/games/rocksndiamonds games:games 0755

12
permissions.secure
View File

@ -246,12 +246,6 @@
/usr/bin/rlogin root:root 4755 /usr/bin/rlogin root:root 4755
/usr/bin/rsh root:root 4755 /usr/bin/rsh root:root 4755
# OpenPBS #66320
/var/spool/pbs/spool root:root 1777
/var/spool/pbs/undelivered root:root 1777
/opt/pbs/sbin/pbs_iff root:root 4755
/opt/pbs/sbin/pbs_rcp root:root 4755
# heartbeat #66310 # heartbeat #66310
# cl_status needs to be allowed to connect to the heartbeat API. If the setgid # cl_status needs to be allowed to connect to the heartbeat API. If the setgid
# bit is removed, one can manually add users to the haclient group instead. # bit is removed, one can manually add users to the haclient group instead.
@ -307,6 +301,9 @@
/opt/kde3/bin/kdesud root:nogroup 2755 /opt/kde3/bin/kdesud root:nogroup 2755
# used for getting proxy settings from dhcp # used for getting proxy settings from dhcp
/opt/kde3/bin/kpac_dhcp_helper root:root 0755 /opt/kde3/bin/kpac_dhcp_helper root:root 0755
# used to distract the oom killer
# #203535
/opt/kde3/bin/start_kdeinit root:root 4755
# edits /etc/smb.conf # edits /etc/smb.conf
# #66312 # #66312
/usr/bin/fileshareset root:root 0755 /usr/bin/fileshareset root:root 0755
@ -432,9 +429,6 @@
# xgalaga # xgalaga
/usr/bin/xgalaga games:games 0755 /usr/bin/xgalaga games:games 0755
# xtetris
/usr/bin/xtetris games:games 0755
# rocksndiamonds # rocksndiamonds
/usr/games/rocksndiamonds games:games 0755 /usr/games/rocksndiamonds games:games 0755

12
permissions.spec
View File

@ -1,5 +1,5 @@
# #
# spec file for package permissions (Version 2007.1.18) # spec file for package permissions (Version 2007.2.25)
# #
# Copyright (c) 2007 SUSE LINUX Products GmbH, Nuernberg, Germany. # Copyright (c) 2007 SUSE LINUX Products GmbH, Nuernberg, Germany.
# This file and all modifications and additions to the pristine # This file and all modifications and additions to the pristine
@ -14,7 +14,7 @@ Name: permissions
License: GNU General Public License (GPL) License: GNU General Public License (GPL)
Group: Productivity/Security Group: Productivity/Security
Autoreqprov: on Autoreqprov: on
Version: 2007.1.18 Version: 2007.2.25
Release: 1 Release: 1
Provides: aaa_base:/etc/permissions Provides: aaa_base:/etc/permissions
Requires: /sbin/SuSEconfig Requires: /sbin/SuSEconfig
@ -75,7 +75,13 @@ install -m 644 %{SOURCE8} $RPM_BUILD_ROOT/etc
/sbin/conf.d/SuSEconfig.permissions /sbin/conf.d/SuSEconfig.permissions
/var/adm/fillup-templates/sysconfig.security /var/adm/fillup-templates/sysconfig.security
%changelog -n permissions %changelog
* Thu Feb 22 2007 - lnussel@suse.de
- prefer package specific permissions files over central ones
(#246252)
* Thu Feb 22 2007 - lnussel@suse.de
- add /opt/kde3/bin/start_kdeinit (#203535)
- remove entries for dropped packages OpenPBS and xtetris
* Wed Jan 17 2007 - lnussel@suse.de * Wed Jan 17 2007 - lnussel@suse.de
- make pam authentication helpers unix_chkpwd, unix2_chkpwd and - make pam authentication helpers unix_chkpwd, unix2_chkpwd and
pam_auth setuid root instead of setgid shadow (#216816) pam_auth setuid root instead of setgid shadow (#216816)