Bug 1835039

Summary:	/etc/frr/ has too wide permissions (0755 rather 0750)
Product:	[Fedora] Fedora	Reporter:	Robert Scheck <redhat-bugzilla>
Component:	frr	Assignee:	Michal Ruprich <mruprich>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	mruprich
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	frr-7.3.1-2.fc32 frr-7.3.1-1.fc31	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-06-27 02:06:18 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Robert Scheck 2020-05-13 00:52:22 UTC

Description of problem:
The directory /etc/frr/ has the permissions frr:frr with 0755. As per (private) e-mail recommendation from the upstream security contact, this should be 0750 instead (like e.g. Debian has). This also would have partially avoided bug #1830805 and its possible information leak.

Version-Release number of selected component (if applicable):
frr-7.3-4.fc33

How reproducible:
Always, see above and below.

Actual results:
/etc/frr/ with frr:frr and 0755

Expected results:
/etc/frr/ with frr:frr and 0750

Additional info:
Upstream mentioned that there will be a note in the future in the docs, too.

Comment 1 Michal Ruprich 2020-06-15 10:38:14 UTC

I agree that 0755 is not good here. I think that 644 or 640 might be much better suited for these config files.

Comment 2 Robert Scheck 2020-06-15 10:39:53 UTC

Yes, but the point here is not only about the (partially dynamically generated) configuration files, but also about the /etc/frr/ directory itself.

Comment 3 Fedora Update System 2020-06-18 10:50:01 UTC

FEDORA-2020-116a61bd59 has been submitted as an update to Fedora 32. https://bodhi.fedoraproject.org/updates/FEDORA-2020-116a61bd59

Comment 4 Fedora Update System 2020-06-19 16:13:58 UTC

FEDORA-2020-efc4892faa has been pushed to the Fedora 31 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-efc4892faa`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-efc4892faa

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2020-06-19 21:55:14 UTC

FEDORA-2020-116a61bd59 has been pushed to the Fedora 32 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-116a61bd59`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-116a61bd59

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2020-06-27 02:06:18 UTC

FEDORA-2020-116a61bd59 has been pushed to the Fedora 32 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 7 Fedora Update System 2020-06-27 03:07:21 UTC

FEDORA-2020-efc4892faa has been pushed to the Fedora 31 stable repository.
If problem still persists, please make note of it in this bug report.