diff options
| author | Marc Espie <espie@cvs.openbsd.org> | 2014-01-25 13:23:16 +0000 |
|---|---|---|
| committer | Marc Espie <espie@cvs.openbsd.org> | 2014-01-25 13:23:16 +0000 |
| commit | b5d951e67eab1d5ac5fcaeb373660f3cdff39a79 (patch) | |
| tree | 4d141dd66c1eb1dc0931ef02c02c6f451ad584fc /usr.sbin/pkg_add | |
| parent | 1272a46299fd0e9f89f6e9dfbbd610876e2192ac (diff) | |
more ArcCheck nits: don't allow a file to be u-r/g-r without an explicit
@mode annotation.
This mostly fixes packaging bugs (like documentation only readable by root
and such nonsense), and also force *actual* mode settings for security
reasons to be apparent in the packing-list.
Diffstat (limited to 'usr.sbin/pkg_add')
| -rw-r--r-- | usr.sbin/pkg_add/OpenBSD/ArcCheck.pm | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/usr.sbin/pkg_add/OpenBSD/ArcCheck.pm b/usr.sbin/pkg_add/OpenBSD/ArcCheck.pm index 67db4c4476b..2da6aeaf2c5 100644 --- a/usr.sbin/pkg_add/OpenBSD/ArcCheck.pm +++ b/usr.sbin/pkg_add/OpenBSD/ArcCheck.pm @@ -1,5 +1,5 @@ # ex:ts=8 sw=4: -# $OpenBSD: ArcCheck.pm,v 1.23 2014/01/17 15:46:16 espie Exp $ +# $OpenBSD: ArcCheck.pm,v 1.24 2014/01/25 13:23:15 espie Exp $ # # Copyright (c) 2005-2006 Marc Espie <espie@openbsd.org> # @@ -87,7 +87,8 @@ sub verify_modes } } if (!defined $item->{mode} && $o->isFile) { - if (($o->{mode} & (S_ISUID | S_ISGID | S_IWOTH)) != 0) { + if (($o->{mode} & (S_ISUID | S_ISGID | S_IWOTH)) != 0 || + ($o->{mode} & S_IROTH) == 0 || ($o->{mode} & S_IRGRP) == 0) { $o->errsay("Error: weird mode for #1: #2", $item->fullname, sprintf("%4o", $o->{mode} & (S_IRWXU | S_IRWXG | S_IRWXO | S_ISUID | S_ISGID))); |