Description of problem:

The subversion RPM package packages the /run/svnserve directory as user root, group root, mode 0755:

$ rpm -qlv subversion | grep /run/svnserve
drwxr-xr-x    2 root    root                        0 Aug  9 09:35 /run/svnserv

Because on RHEL7 the /run directory is tmpfs and therefore /run/svnserve will disappear at every reboot, the subversion package contributes a /usr/lib/tmpfiles.d/svnserve.conf file that contains:

$ cat /usr/lib/tmpfiles.d/svnserve.conf
D /run/svnserve 0700 root root -

Therefore, systemd-tmpfiles creates /run/svnserve with a mode that disagrees with the RPM package:

$ rpm --verify subversion
.M.......    /run/svnserve

Thus, the Subversion packaging is broken, and should be corrected.

This might not seem like a big deal, but on hosts that are required to comply with the United States Government Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), when a package's on-disk contents differs in owners, groups, or file modes from what the package database asserts is correct, that is a Category I finding (the most severe finding).

Version-Release number of selected component (if applicable):

subversion-1.7.14-11.el7_4.x86_64

How reproducible:

Running the following commands will demonstrate the problem:

$ yum erase subversion
$ rm -rf /run/svnserve
$ yum install subversion
$ rpm --verify subversion; echo EOF
EOF
$ systemd-tmpfiles --create
$ rpm --verify subversion; echo EOF
.M.......    /run/svnserve
EOF

Actual results:

After systemd-tmpfiles --create runs, it changes the permissions of the /run/svnserve directory to disagree with the subversion RPM package, which rpm --verify will then flag.

Expected results:

systemd-tmpfiles --create should create /run/svnserve with attributes (owner, group, mode) that match the RPM package.

Additional info:

I think the correct thing to do here is to modify the subversion RPM package's SPEC file to package /run/svnserve mode 0700, instead of changing /usr/lib/tmpfiles.d/svnserve.conf to create /run/svnserve as mode 0755.

Because systemd-tmpfiles is already enforcing mode 0700, this would represent no change to the installed subversion package; it would merely align the RPM packaging with the state of the installed package.