Bug 197129
| Summary: | games/scid: vulnerable files with mode 666 below /usr/local/share/scid/books | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Ports & Packages | Reporter: | DW <dweber> | ||||
| Component: | Individual Port(s) | Assignee: | freebsd-ports-bugs (Nobody) <ports-bugs> | ||||
| Status: | Closed Overcome By Events | ||||||
| Severity: | Affects Many People | CC: | bsd, cs, riggs, shoesoft | ||||
| Priority: | --- | Keywords: | needs-patch | ||||
| Version: | Latest | Flags: | vlad-fbsd:
maintainer-feedback+
|
||||
| Hardware: | Any | ||||||
| OS: | Any | ||||||
| Attachments: |
|
||||||
Maintainer CC'd It seems that the file permissions are set so on purpose, in order to enable all users to contribute to the books. But this probably shouldn't be the default state. I agree that install -m 644 ./books/*.* $(SHAREDIR)/books/ instead of install -m 666 ./books/*.* $(SHAREDIR)/books/ and therefore adding that change to files/patch-Makefile.conf would certainly be a good idea. Every user is free to copy the books directory to his own home directory and make that copy writable for whoever desired. well, why aren't the BSD_INSTALL_* macros being used instead of this hardcoding? Guys, what's the status of this? Works as intended? Requires a fix? Problem persists on a ports tree as of Thu Jun 9 19:26:06 UTC 2016 INSTALL_DATA should be appropriate instead from install -m 666 ... which is found in files/patch-Makefile.conf (last modified Nov 7 2015) Created attachment 171462 [details]
patch removing hardcoded file permissions
@Vladimir Krstulja: Yes and yes. It works as expected, but requires a fix for (theoretical) security reasons.
I just followed John Marino's suggestion to use INSTALL_* macros. Unfortunately, some useful macros such as MKDIR and COPYTREE_SHARE are not exported, so we have to stick to literal install -d or mkdir for directories, and the "find" command in the makefile looks ugly. Of course we could move the file copying and directory creation to a do-install section in games/scid/Makefile (where we could use all of the macros), but that would be even more difficult to maintain.
So here's my patch, please check out if I did it right and if everything is still working.
Works for me. Thank you very much. Can someone commit this, please? I've just submitted Bug 214842 which updates scid to the latest version. The update contains a new patch (without the BSD_INSTALL_* macros for now) because the old patch no longer applies. Resolved with bug 214842 |
installing from ports produces the message SECURITY REPORT: This port has installed the following world-writable files/directories. /usr/local/share/scid/books/readme.txt /usr/local/share/scid/books/gm2600.bin /usr/local/share/scid/books/varied.bin /usr/local/share/scid/books/Performance.bin /usr/local/share/scid/books/Elo2400.bin so chmod 644 /usr/local/share/scid/books/* should be appropriate