Bug 19245 - ssmtp conf files installed as setgid root?
Summary: ssmtp conf files installed as setgid root?
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal minor
Target Milestone: Mageia 7
Assignee: Johnny A. Solbu
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-25 10:13 CEST by Panos Christeas
Modified: 2017-08-09 14:56 CEST (History)
0 users

See Also:
Source RPM: ssmtp-2.64-13.mga4.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Panos Christeas 2016-08-25 10:13:33 CEST 
A little remark on the %files section:
Files

drwxr-s---	 80 	  root	 mail	 /etc/ssmtp
-rwxr-s---	 200 	 root	 mail	 /etc/ssmtp/revaliases
-rwxr-s---	 1488	 root	 mail	 /etc/ssmtp/ssmtp.conf

Is there a reason/purpose why g+s is set?
Also, u+x on those conf files may be pointless, isn't it?
Jani Välimaa 2016-08-25 15:25:39 CEST

Summary: Why are conf installed as setgid root? => ssmtp conf files installed as setgid root?

David Walser 2016-08-25 17:18:00 CEST

Assignee: bugsquad => cooker

Comment 1 Johnny A. Solbu 2017-06-05 10:34:36 CEST 
(In reply to Panos Christeas from comment #0)
> Is there a reason/purpose why g+s is set?

It is a security fix. See bug 10701 and this advisory for details: http://advisories.mageia.org/MGAA-2013-0064.html

> Also, u+x on those conf files may be pointless, isn't it?

I can fix the execute bit on the conf files when release freeze lifts after mga6 is released.

Version: 5 => Cauldron
Target Milestone: --- => Mageia 7
Status: NEW => ASSIGNED

Comment 2 Panos Christeas 2017-06-05 11:45:34 CEST 
Fair enough, then.
A comment in the SPEC file, about this, would help not ask this question again.
Comment 3 Johnny A. Solbu 2017-08-09 14:56:17 CEST 
Fixed in Cauldron

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.