Bug 559545
| Summary: | /var/log/abrt.log is system-wide readable | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Ralf Corsepius <rc040203> |
| Component: | abrt | Assignee: | Jiri Moskovcak <jmoskovc> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | low | ||
| Version: | 12 | CC: | anton, dfediuck, dvlasenk, iprikryl, jmoskovc, kklic, mnowak, npajkovs |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | 1.0.6-1.fc12 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-02-09 21:03:35 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Ralf Corsepius
2010-01-28 12:40:15 UTC
If you want to restrict the access to this file: edit /etc/init.d/abrtd and add "umask 077" in the relevant place or edit /etc/abrt/plugins/Logger.conf and send output to a file with more restrictive mode or disable Logger plugin altogether in /etc/abrt/abrt.conf (In reply to comment #1) > If you want to restrict the access to this file: No. Setting protections needs to be done inside of your rpms - It's a basic packaging bug. Guess why /var/log/messages and other log files are not system-wide readable? Exactly because they may contain private and confidential information, ordinary users are not supposed to be able to access. Many other files are in fact readable: # ls -l /var/log | grep -- ^-.*r-*r- -rw-r--r-- 1 root root 73239 2010-01-28 18:50 abrt.log -rw-r--r-- 1 root root 1968 2010-01-29 09:34 boot.log -rw-r--r-- 1 root root 45529 2010-01-29 09:34 dmesg -rw-r--r-- 1 root root 44052 2010-01-29 04:56 dmesg.old -rw-r--r--. 1 root root 146292 2010-01-25 02:10 lastlog -rw-r--r--. 1 root root 0 2009-07-14 11:01 mcelog -rw-r--r-- 1 root root 89 2010-01-29 09:34 pm-powersave.log -rw-r--r-- 1 root root 5524 2009-12-28 03:18 pm-suspend.log -rw-r--r--. 1 root root 47289 2009-07-15 11:26 rpmpkgs -rw-r--r--. 1 root root 0 2009-07-14 10:48 wpa_supplicant.log -rw-r--r-- 1 root root 60227 2010-01-29 09:52 Xorg.0.log -rw-r--r-- 1 root root 36606 2010-01-29 09:14 Xorg.0.log.old -rw-r--r-- 1 root root 76834 2009-12-10 20:09 Xorg.1.log -rw-r--r-- 1 root root 40188 2009-07-20 01:02 Xorg.1.log.old -rw-r--r-- 1 root root 76318 2009-12-10 20:09 Xorg.2.log -rw-r--r-- 1 root root 45152 2009-07-20 01:03 Xorg.2.log.old -rw-r--r-- 1 root root 38947 2009-07-20 01:04 Xorg.3.log -rw-r--r--. 1 root root 93102 2010-01-28 12:14 yum.log Ok. I don't want to argue with every security obsessed guy, they seem to have an infinite capacity and iron will to make it as unpleasant to use Linux as possible for ordinary (non-root) users, so I changed the mode to 0600 in abrt source. I hope at least you feel happier, because I don't. I always run my machine with SElinux off and under root. Was never, ever hacked. abrt-1.0.6-1.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/abrt-1.0.6-1.fc12 abrt-1.0.6-1.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update abrt'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-1470 abrt-1.0.6-1.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. |