Re: [ptxdist] [PATCH] bugfix: kernel: install modules with 755 permission

[Bruno Thomsen <bruno.thomsen@gmail.com>]

Den tir. 7. jul. 2020 kl. 12.06 skrev Michael Olbrich
<m.olbrich@pengutronix.de>:
> > > Hmmm, you're running ptxdist with a 0002 umask, right?[1]
> >
> > Yes, I am running ptxdist with 0002 umask as a user.
> >
> > On Fedora users run with 0002 umask and root runs with 0022 umask,
> > but ptxdist does not support building as root, e.g. rootless
> > containers (podman).
> >
> > $ podman run --rm -it fedora:32
> > [root@7940c80a5df2 /]# whoami
> > root
> > [root@7940c80a5df2 /]# umask
> > 0022
> >
> > So requiring that umask seems a little counter intuitive to me.
>
> The problem is, that a lot of packages don't explicitly set the permissions
> when creating files or directories during 'make install'.
> Especially directories are often created with a simple 'mkdir'.
> As a result, the permissions depend on your current umask.
>
> And then install_tree looks just takes that permission. At that point
> PTXdist cannot know, if the permission was explicitly set like this or not,
> so we cannot do a fixup.
>
> We could change the umask during the ptxdist run, but I'm reluctant to do
> this because the umask is a security feature and just changing it feels
> wrong to me.
> Hmm, maybe we could just make it strikter:
>
> mask="$(umask)"
> if [ "$(( (mask | 0022) & 0755))" -eq 0 ]; then
>         umask 0022
> else
>         # fail here?
> fi
>
> or something like that?

Given the use-case I think your suggestion makes sense; Make umask
stricter when ptxdist is started with something like 0000 or 0002. Keep
umask 0022, and fail in case it's started with another umask.
This will make it consistent with how ptxdist handles being started with
UID = 0.

Fail trace suggestion:
ptxdist: error: refusing to run PTXdist with umask ${mask}.

/Bruno

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de