Bug 15650

Summary:	msec is flagging a "violation" by avahi ... wrong home directories for avahi sysem users
Product:	Mageia	Reporter:	Florian Hubold <doktor5000>
Component:	RPM Packages	Assignee:	Mageia Bug Squad <bugsquad>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Normal	CC:	davidwhodgins, derekjenn, doktor5000, george, luigiwalser, martynvidler, shlomif, sysadmin-bugs
Version:	5
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:	avahi-0.6.31-2.1.mga3.src.rpm	CVE:
Status comment:
Bug Depends on:	10004, 10469
Bug Blocks:
Attachments:	A Patch porting the changes for Cauldron New Patch which incorporates Luigi's commentary.

Description Florian Hubold 2015-04-07 20:35:33 CEST

+++ This bug was initially created as a clone of Bug #10004 +++

The fixes that were applied to mga3 updates have never made it to cauldron, so the bug is currently still present in cauldron and mga4. The fixes from Derek were: http://svnweb.mageia.org/packages/updates/3/avahi/current/SPECS/avahi.spec?r1=423048&r2=448108
================================================================
original report follows


Description of problem:

msec does not like the avahi home directory arrangement.  I don't know if this is a problem with avahi or with msec.  I suspect that msec should not be looking at this issue when it involves system accounts as opposed to user accounts.  But perhaps avahi has a problem.  In any case it needs to be reviewed.

Version-Release number of selected component (if applicable):


How reproducible:

View msec output to log:

================================================================

*** Security Check, May 06 07:51:55 ***
*** Check type: daily ***
*** Check executed from: /etc/cron.daily/msec ***
Report summary:
Test started: May 06 07:51:55
Test finished: May 06 07:51:58
Total of users whose home directories have unsafe permissions : 1
Total of open network ports: 12
Total of configured firewall rules: 84
Total local users: 31
Total local group: 55

Detailed report:

Security Warning: these home directory should not be owned by someone else or writable :
user=avahi(496) : home directory is owned by avahi-autoipd(495).

=================================================================

Steps to Reproduce:
1.
2.
3.


Reproducible: 

Steps to Reproduce:

Comment 1 Florian Hubold 2015-04-07 20:36:48 CEST

Adding current maintainer in CC.

Keywords: Junior_job, validated_update => (none)
CC: (none) => doktor5000, luigiwalser, shlomif
Whiteboard: (none) => MGA4TOO

Comment 2 Shlomi Fish 2015-04-08 08:08:56 CEST

Created attachment 6218 [details]
A Patch porting the changes for Cauldron

This patch ports the changes for Cauldron. The package seems to build fine, but I didn't try to install it.

Jani Välimaa 2015-04-08 09:26:48 CEST

CC: jani.valimaa => (none)

Comment 3 David Walser 2015-04-08 14:16:57 CEST

(In reply to Shlomi Fish from comment #2)
> Created attachment 6218 [details]
> A Patch porting the changes for Cauldron
> 
> This patch ports the changes for Cauldron. The package seems to build fine,
> but I didn't try to install it.

The Conflicts tag isn't needed.  That was present in the original change because he also moved avahi-dnsconfd.service to a different subpackage.

Otherwise it looks OK, but I wonder about using getent in scriplets (though, granted, Fedora does the same in their avahi), as if you're using a network-based authentication, it'll attempt to access those sources, even though this is a local system user.  If the network isn't up it could potentially cause hangs.  Might be better to just grep /etc/passwd directly.

Comment 4 Shlomi Fish 2015-04-08 17:51:58 CEST

Created attachment 6222 [details]
New Patch which incorporates Luigi's commentary.

Comment 5 David Walser 2015-04-08 17:57:48 CEST

(In reply to Shlomi Fish from comment #4)
> Created attachment 6222 [details]
> New Patch which incorporates Luigi's commentary.

Only minor nit is the input redirection operator isn't necessary since grep will read from a file given as a command-line argument, but it looks like this should work.

Comment 6 Shlomi Fish 2015-04-09 11:58:02 CEST

(In reply to David Walser from comment #5)
> (In reply to Shlomi Fish from comment #4)
> > Created attachment 6222 [details]
> > New Patch which incorporates Luigi's commentary.
> 
> Only minor nit is the input redirection operator isn't necessary since grep
> will read from a file given as a command-line argument, but it looks like
> this should work.

I'm doing the input redirection as a cautionary measure against including the filename in the output.

Comment 7 David Walser 2015-04-09 12:41:44 CEST

(In reply to Shlomi Fish from comment #6)
> I'm doing the input redirection as a cautionary measure against including
> the filename in the output.

grep only does that if you ask it to read from multiple files.

Comment 8 David Walser 2015-04-18 18:31:52 CEST

avahi-0.6.31-16.mga5 has been uploaded for Cauldron.

Version: Cauldron => 4
Whiteboard: MGA4TOO => (none)

Comment 9 Florian Hubold 2015-06-01 21:51:20 CEST

Will this be also issued for mga4 ?

Comment 10 Samuel Verschelde 2015-09-21 13:20:27 CEST

Mageia 4 changed to end-of-life (EOL) status on 2015-09-19. It is is no longer 
maintained, which means that it will not receive any further security or bug 
fix updates.

Package Maintainer: If you wish for this bug to remain open because you plan to 
fix it in a currently maintained version, simply change the 'version' to a later 
Mageia version.

Bug Reporter: Thank you for reporting this issue and we are sorry that we weren't 
able to fix it before Mageia 4's end of life. If you are able to reproduce it 
against a later version of Mageia, you are encouraged to click on "Version" and 
change it against that version of Mageia. If it's valid in several versions, 
select the highest and add MGAxTOO in whiteboard for each other valid release.
Example: it's valid in cauldron and Mageia 5, set to cauldron and add MGA5TOO.

Although we aim to fix as many bugs as possible during every release's lifetime, 
sometimes those efforts are overtaken by events. Often a more recent Mageia 
release includes newer upstream software that fixes bugs or makes them obsolete.

If you would like to help fixing bugs in the future, don't hesitate to join the
packager team via our mentoring program [1] or join the teams that fit you 
most [2].

[1] https://wiki.mageia.org/en/Becoming_a_Mageia_Packager
[2] http://www.mageia.org/contribute/

Comment 11 Shlomi Fish 2015-09-21 14:22:30 CEST

Fixed in cauldron so RESOLVEDing as FIXED.

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 12 Samuel Verschelde 2015-09-21 14:32:48 CEST

What about Mageia 5?

Comment 13 Shlomi Fish 2015-09-21 14:37:52 CEST

(In reply to Samuel VERSCHELDE from comment #12)
> What about Mageia 5?

It should be fixed there as well.

Rémi Verschelde 2015-09-21 15:07:46 CEST

Version: 4 => 5