Reviewed-by: Adolf Belka adolf.belka@ipfire.org
On 30/04/2022 12:05, Peter Müller wrote:
Lynis (rightly) complains about this directory and its contents being world-readable on current IPFire installations. Since there is no necessity for this, we might as well chmod them to 750 / 640.
Signed-off-by: Peter Müller peter.mueller@ipfire.org
lfs/logwatch | 4 ++-- lfs/setup | 4 ++++ lfs/zabbix_agentd | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/lfs/logwatch b/lfs/logwatch index 26da2c62e..8631f4541 100644 --- a/lfs/logwatch +++ b/lfs/logwatch @@ -106,8 +106,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) ln -vsf /usr/share/logwatch/default.conf /etc/logwatch/conf
-mkdir -p /etc/sudoers.d
- chmod -v 755 /etc/sudoers.d
- install -v -m 644 $(DIR_SRC)/config/logwatch/sudoers/logwatch-mdadm \
chmod -v 750 /etc/sudoers.d
install -v -m 640 $(DIR_SRC)/config/logwatch/sudoers/logwatch-mdadm \ /etc/sudoers.d/logwatch-mdadm
@rm -rf $(DIR_APP)
diff --git a/lfs/setup b/lfs/setup index 5779406ef..82286d6a0 100644 --- a/lfs/setup +++ b/lfs/setup @@ -58,5 +58,9 @@ $(TARGET) : --with-config-root="$(CONFIG_ROOT)" cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install
- # Fix file permissions of /etc/sudoers.d/setup
- chmod 640 /etc/sudoers.d/setup
- @rm -rf $(DIR_APP) @$(POSTBUILD)
diff --git a/lfs/zabbix_agentd b/lfs/zabbix_agentd index c44f2b5f5..63566c1a7 100644 --- a/lfs/zabbix_agentd +++ b/lfs/zabbix_agentd @@ -113,7 +113,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(call INSTALL_INITSCRIPTS,$(SERVICES))
# Install sudoers include file
- install -v -m 644 $(DIR_SRC)/config/zabbix_agentd/sudoers \
install -v -m 640 $(DIR_SRC)/config/zabbix_agentd/sudoers \ /etc/sudoers.d/zabbix
# Install include file for backup