+++ This bug was initially created as a clone of Bug #10004 +++ The fixes that were applied to mga3 updates have never made it to cauldron, so the bug is currently still present in cauldron and mga4. The fixes from Derek were: http://svnweb.mageia.org/packages/updates/3/avahi/current/SPECS/avahi.spec?r1=423048&r2=448108 ================================================================ original report follows Description of problem: msec does not like the avahi home directory arrangement. I don't know if this is a problem with avahi or with msec. I suspect that msec should not be looking at this issue when it involves system accounts as opposed to user accounts. But perhaps avahi has a problem. In any case it needs to be reviewed. Version-Release number of selected component (if applicable): How reproducible: View msec output to log: ================================================================ *** Security Check, May 06 07:51:55 *** *** Check type: daily *** *** Check executed from: /etc/cron.daily/msec *** Report summary: Test started: May 06 07:51:55 Test finished: May 06 07:51:58 Total of users whose home directories have unsafe permissions : 1 Total of open network ports: 12 Total of configured firewall rules: 84 Total local users: 31 Total local group: 55 Detailed report: Security Warning: these home directory should not be owned by someone else or writable : user=avahi(496) : home directory is owned by avahi-autoipd(495). ================================================================= Steps to Reproduce: 1. 2. 3. Reproducible: Steps to Reproduce:
Adding current maintainer in CC.
Keywords: Junior_job, validated_update => (none)CC: (none) => doktor5000, luigiwalser, shlomifWhiteboard: (none) => MGA4TOO
Created attachment 6218 [details] A Patch porting the changes for Cauldron This patch ports the changes for Cauldron. The package seems to build fine, but I didn't try to install it.
CC: jani.valimaa => (none)
(In reply to Shlomi Fish from comment #2) > Created attachment 6218 [details] > A Patch porting the changes for Cauldron > > This patch ports the changes for Cauldron. The package seems to build fine, > but I didn't try to install it. The Conflicts tag isn't needed. That was present in the original change because he also moved avahi-dnsconfd.service to a different subpackage. Otherwise it looks OK, but I wonder about using getent in scriplets (though, granted, Fedora does the same in their avahi), as if you're using a network-based authentication, it'll attempt to access those sources, even though this is a local system user. If the network isn't up it could potentially cause hangs. Might be better to just grep /etc/passwd directly.
Created attachment 6222 [details] New Patch which incorporates Luigi's commentary.
(In reply to Shlomi Fish from comment #4) > Created attachment 6222 [details] > New Patch which incorporates Luigi's commentary. Only minor nit is the input redirection operator isn't necessary since grep will read from a file given as a command-line argument, but it looks like this should work.
(In reply to David Walser from comment #5) > (In reply to Shlomi Fish from comment #4) > > Created attachment 6222 [details] > > New Patch which incorporates Luigi's commentary. > > Only minor nit is the input redirection operator isn't necessary since grep > will read from a file given as a command-line argument, but it looks like > this should work. I'm doing the input redirection as a cautionary measure against including the filename in the output.
(In reply to Shlomi Fish from comment #6) > I'm doing the input redirection as a cautionary measure against including > the filename in the output. grep only does that if you ask it to read from multiple files.
avahi-0.6.31-16.mga5 has been uploaded for Cauldron.
Version: Cauldron => 4Whiteboard: MGA4TOO => (none)
Will this be also issued for mga4 ?
Mageia 4 changed to end-of-life (EOL) status on 2015-09-19. It is is no longer maintained, which means that it will not receive any further security or bug fix updates. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Mageia version. Bug Reporter: Thank you for reporting this issue and we are sorry that we weren't able to fix it before Mageia 4's end of life. If you are able to reproduce it against a later version of Mageia, you are encouraged to click on "Version" and change it against that version of Mageia. If it's valid in several versions, select the highest and add MGAxTOO in whiteboard for each other valid release. Example: it's valid in cauldron and Mageia 5, set to cauldron and add MGA5TOO. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Mageia release includes newer upstream software that fixes bugs or makes them obsolete. If you would like to help fixing bugs in the future, don't hesitate to join the packager team via our mentoring program [1] or join the teams that fit you most [2]. [1] https://wiki.mageia.org/en/Becoming_a_Mageia_Packager [2] http://www.mageia.org/contribute/
Fixed in cauldron so RESOLVEDing as FIXED.
Status: NEW => RESOLVEDResolution: (none) => FIXED
What about Mageia 5?
(In reply to Samuel VERSCHELDE from comment #12) > What about Mageia 5? It should be fixed there as well.
Version: 4 => 5