FS#17533 - [makepkg] Remove setgid from pkgdir

Attached to Project: Pacman
Opened by Jan Alexander Steffens (heftig) - Thursday, 17 December 2009, 03:30 GMT
Last edited by Allan McRae (Allan) - Tuesday, 30 March 2010, 05:02 GMT
Task Type Bug Report
Category makepkg
Status Closed
Assigned To No-one
Architecture All
Severity Low
Priority Normal
Reported Version 3.3.3
Due in Version 3.4.0
Due Date Undecided
Percent Complete 100%
Votes 1
Private No

Details

Summary and Info:
Makepkg should remove setgid from pkgdir before building. Otherwise, the flag will be carried over to subdirs and eventually into the package.

Steps to Reproduce:
1. Create a directory with permissions 2755
2. Put a PKGBUILD in it (linuxigd from AUR in my case)
3. Build using makepkg
4. Observe directory permissions in resulting package
---- In the case of linuxigd, pkg/etc/rc.d and pkg/etc/conf.d will now have 2755 permissions
This task depends upon

Closed by  Allan McRae (Allan)
Tuesday, 30 March 2010, 05:02 GMT
Reason for closing:  Implemented
Additional comments about closing:  http://projects.archlinux.org/pacman.git /commit/?id=22331fda
Comment by Dan McGee (toofishes) - Thursday, 17 December 2009, 03:43 GMT
I agree there is a problem, but disagree with the fix. Instead, we should ensure we create these directories explicitly with 0755 permissions.
Comment by Andres Perera (pwd) - Thursday, 17 December 2009, 04:48 GMT
Stating 0755 with chmod, install or otherwise won't clear setgid if it matches the user's effective group. man chmod

$ groups
wheel video audio users

$ ls -ld .
drwxr-sr-x 4 user users 4.0K Dec 17 00:03 .

$ umask 0022; install -dm0755 pkg src; ls -ld pkg src
drwxr-sr-x 2 user users 4.0K Dec 17 00:03 pkg
drwxr-sr-x 2 user users 4.0K Dec 17 00:03 src

$ chmod 0755 pkg src; ls -ld pkg src
drwxr-sr-x 2 user users 4.0K Dec 17 00:03 pkg
drwxr-sr-x 2 user users 4.0K Dec 17 00:04 src

So the fix is what he proposed:
$ chmod a=-s pkg src; ls -ld pkg src
drwxr-xr-x 2 user users 4.0K Dec 17 00:04 pkg
drwxr-xr-x 2 user users 4.0K Dec 17 00:04 src
Comment by Dan McGee (toofishes) - Wednesday, 20 January 2010, 05:26 GMT
Possible patch:
http://mailman.archlinux.org/pipermail/pacman-dev/2010-January/010348.html
Comment by Allan McRae (Allan) - Saturday, 06 March 2010, 12:05 GMT
Patch pushed to my working branch.

Loading...