mailarchive of the ptxdist mailing list
 help / color / mirror / Atom feed
From: Nico Lastzka <Nico.Lastzka@ATSonline.de>
To: ptxdist@pengutronix.de
Subject: [ptxdist] Hard-coded directory permissions
Date: Wed, 10 Jun 2020 11:35:24 +0200	[thread overview]
Message-ID: <20200610093524.GG4898@develop-10-146> (raw)

Hi,

I ran into a problem with the latest ptxdist 2020.06 when trying to install an ssh key to
"/root/.ssh/authorized_keys".

--8<--------------------

#> ptxdist images

... # output skipped

Incompatible ownership or permissions for '/root':
image-enhancements: 0.0 0755 (implicit)
rootfs: 0.0 0700
One of these packages must be fixed!

-------------------->8--

Here, the "image-enhancements rule" contains the following code which breaks the image creation:

     @$(call install_copy, image_enhancements, 0, 0, 0400, $(PTXDIST_PLATFORMCONFIGDIR)/access/key-develop_id_ed25519.pub, /root/.ssh/authorized_keys )

I found the code in "scripts/lib/ptxd_lib_check_dir_permissions.awk" to be responsible for this
issue. In this file the directory permissions are hardcoded. The following "patch" is my current
workaround for this problem:

--8<--------------------

diff --git a/scripts/lib/ptxd_lib_check_dir_permissions.awk b/scripts/lib/ptxd_lib_check_dir_permissions.awk
index 9bd009f04..4ad132561 100644                                                                           
--- a/scripts/lib/ptxd_lib_check_dir_permissions.awk                                                        
+++ b/scripts/lib/ptxd_lib_check_dir_permissions.awk                                                        
@@ -33,6 +33,9 @@ $1 ~ "f" {                                                                                
                 path = gensub(/\/[^/]*$/,"",1,path)                                                         
                 if (path == "")                                                                             
                         break;                                                                              
-               check(path, "0.0 0755", 1)                                                                  
+               if (path == "/root")                                                                        
+                       check(path, "0.0 0700", 1)                                                          
+               else                                                                                        
+                       check(path, "0.0 0755", 1)                                                          
         }                                                                                                   
  }                                                                                                          

-------------------->8--

What would be a proper solution to this problem?

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de

             reply	other threads:[~2020-06-10  9:35 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-10  9:35 Nico Lastzka [this message]
2020-06-10 11:32 ` Bruno Thomsen
2020-06-10 11:42   ` Nico Lastzka
2020-06-11  5:46     ` Michael Olbrich
2020-06-11  6:19       ` Nico Lastzka
2020-06-12  6:51         ` Michael Olbrich

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200610093524.GG4898@develop-10-146 \
    --to=nico.lastzka@atsonline.de \
    --cc=ptxdist@pengutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox