From mboxrd@z Thu Jan  1 00:00:00 1970
From: Adolf Belka <adolf.belka@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH] Do not permit world-readability of /etc/sudoers.d/
Date: Sun, 01 May 2022 19:00:16 +0200
Message-ID: <93ff6789-40ca-f30f-56ca-355fa66ef8c1@ipfire.org>
In-Reply-To: <43e66e1b-b231-8869-4348-8172d820d7a5@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2338805764218278187=="
List-Id: <development.lists.ipfire.org>

--===============2338805764218278187==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

Reviewed-by: Adolf Belka <adolf.belka(a)ipfire.org>

On 30/04/2022 12:05, Peter Müller wrote:
> Lynis (rightly) complains about this directory and its contents being
> world-readable on current IPFire installations. Since there is no
> necessity for this, we might as well chmod them to 750 / 640.
>
> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
> ---
>   lfs/logwatch      | 4 ++--
>   lfs/setup         | 4 ++++
>   lfs/zabbix_agentd | 2 +-
>   3 files changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/lfs/logwatch b/lfs/logwatch
> index 26da2c62e..8631f4541 100644
> --- a/lfs/logwatch
> +++ b/lfs/logwatch
> @@ -106,8 +106,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
>   	ln -vsf /usr/share/logwatch/default.conf /etc/logwatch/conf
>   
>   	-mkdir -p /etc/sudoers.d
> -	chmod -v 755 /etc/sudoers.d
> -	install -v -m 644 $(DIR_SRC)/config/logwatch/sudoers/logwatch-mdadm \
> +	chmod -v 750 /etc/sudoers.d
> +	install -v -m 640 $(DIR_SRC)/config/logwatch/sudoers/logwatch-mdadm \
>                   /etc/sudoers.d/logwatch-mdadm
>   
>   	@rm -rf $(DIR_APP)
> diff --git a/lfs/setup b/lfs/setup
> index 5779406ef..82286d6a0 100644
> --- a/lfs/setup
> +++ b/lfs/setup
> @@ -58,5 +58,9 @@ $(TARGET) :
>   		--with-config-root="$(CONFIG_ROOT)"
>   	cd $(DIR_APP) && make $(MAKETUNING)
>   	cd $(DIR_APP) && make install
> +
> +	# Fix file permissions of /etc/sudoers.d/setup
> +	chmod 640 /etc/sudoers.d/setup
> +
>   	@rm -rf $(DIR_APP)
>   	@$(POSTBUILD)
> diff --git a/lfs/zabbix_agentd b/lfs/zabbix_agentd
> index c44f2b5f5..63566c1a7 100644
> --- a/lfs/zabbix_agentd
> +++ b/lfs/zabbix_agentd
> @@ -113,7 +113,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
>   	@$(call INSTALL_INITSCRIPTS,$(SERVICES))
>   
>   	# Install sudoers include file
> -	install -v -m 644 $(DIR_SRC)/config/zabbix_agentd/sudoers \
> +	install -v -m 640 $(DIR_SRC)/config/zabbix_agentd/sudoers \
>   		/etc/sudoers.d/zabbix
>   
>   	# Install include file for backup

--===============2338805764218278187==--