Bug 1139177 - sa-update breaks permissions
Summary: sa-update breaks permissions
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: spamassassin
Version: 20
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Kevin Fenzi
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-09-08 10:14 UTC by Harald Reindl
Modified: 2014-09-08 22:11 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-09-08 22:11:29 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Harald Reindl 2014-09-08 10:14:45 UTC
after "sa-update" you likely get serious problems if you are running as milter-user or otherwise restricted permissions because the updated rules folder get chmod 750

config: cannot open "/var/lib/spamassassin/3.004000/updates_spamassassin_org.cf"

happily i worked around with that in my systemd-unit which is called after successful updates by restart spamd, but that should not happen at all

[Service]
Environment="TMPDIR=/tmp"
PermissionsStartOnly=true
ExecStartPre=/usr/bin/find /var/lib/spamassassin/ -type d -exec /bin/chmod 0755 "{}" \;
ExecStartPre=/usr/bin/find /var/lib/spamassassin/ -type f -exec /bin/chmod 0644 "{}" \;
ExecStart=/usr/bin/spamd -c -H --max-children=25 --min-children=10 --min-spare=5 --max-spare=15 --port=10027
ExecReload=/usr/bin/kill -HUP $MAINPID
Environment="LANG=en_GB.UTF-8"
User=sa-milt
Group=sa-milt
Nice=15
StandardOutput=null
StandardError=null
SyslogFacility=mail
Restart=always
RestartSec=1

Comment 1 Kevin Fenzi 2014-09-08 21:52:17 UTC
I'm not seeing this here. 

You are running sa-update from it's normal cron job?

Do you have a more restrictive root umask setup anywhere?

Comment 2 Harald Reindl 2014-09-08 21:56:39 UTC
> You are running sa-update from it's normal cron job?

yes, that's why it happily restarts the daemon
and so triggers the find/chmod command of my
systemd-unit while call "sa-update" with my
typical environment don't so

> Do you have a more restrictive root umask setup anywhere?

pretty sure, hardened server environments
0027 except httpd with enforces group write and no access for "others"

Comment 3 Kevin Fenzi 2014-09-08 22:11:29 UTC
(In reply to Harald Reindl from comment #2)

> > Do you have a more restrictive root umask setup anywhere?
> 
> pretty sure, hardened server environments
> 0027 except httpd with enforces group write and no access for "others"

Well then, there you go. From 'man sa-update':

"The program sa-update uses the underlying operating system umask for the
updated rule files it installs. "

You could set the umask back in the cron job before calling it I suppose...


Note You need to log in before you can comment on or make changes to this bug.