Re: rpm postinst etc. scripts and permissions: -rw-rw-r-- root fou4s

On Sun, 1 Feb 2004, Lars Ellenberg wrote:

> SuSE 9.0, fou4s 0.11
> I noticed after updateing some packages backups of config files
> like "-rw-rw-r-- root fou4s", so I guess rpm pre/post install
> scripts are executed with umask and gid inherited from fou4s: sg
> fou4s, umask 002 this might have security implications.

Uh-uh; and it seems that earlier version of fou4s have the same problem.

> maybe the actual rpm -Uhv should be done as
> ( umask 077; su - -c "rpm -Uhv ..." )
> or some such.

The "umask 077" doesn't have any effect, since "su -" resets the umask
to its default value - just try "( umask 077 ; su - -c umask )".

(Besides, I think the default "022" would be a better choice anyway;
an RPM that needs tighter permissions can take care of this itself...)

Martin



--