Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: Three systemd unit files shipped by grub2-tools have executable permissions (0755) instead of the required 0644. This is a regression from Fedora 44. Per Fedora Packaging Guidelines for Systemd: "Unit files and drop-ins must be world-readable (i.e. mode 0644)" https://docs.fedoraproject.org/en-US/packaging-guidelines/Systemd/ Version-Release number of selected component: grub2-tools-2.12-73.fc45.aarch64 How reproducible: Always (100%) Steps to Reproduce: 1. Install grub2-tools-2.12-73.fc45 2. Run: stat -c "%a %n" /usr/lib/systemd/system/grub-boot-indeterminate.service /usr/lib/systemd/system/grub2-systemd-integration.service /usr/lib/systemd/user/grub-boot-success.service 3. Run: rpm -ql --dump grub2-tools | grep ".service" Actual Results: All three service files have mode 0755: 755 /usr/lib/systemd/system/grub-boot-indeterminate.service 755 /usr/lib/systemd/system/grub2-systemd-integration.service 755 /usr/lib/systemd/user/grub-boot-success.service Expected Results: All three service files should have mode 0644. Additional info: - Regression: grub2-tools-2.12-60.fc44 ships all three files with correct 0644 permissions. The file contents (SHA256) are identical between F44 and F45 - only the permissions changed. - Note: The drop-in 10-grub2-logind-service.conf is correctly 0644 in both versions.
reproduced. Looking briefly, there is nothing on the spec that change the permissions for these files. I wonder if something change on rpm or system permission defaults.
Hi @pmatilai, I found a behavior change in rpmbuild between rpm 6.0.1 (F44) and 6.0.92 (F45). When a spec uses `install -p` without `-m`, rpmbuild 6.0.1 (or just something in f44) was normalizing file permissions to 0644, but 6.0.92 now keeps 0755 as set by the install command. Same spec, no %defattr. This broke systemd unit file permissions on ~21 packages after F45 mass rebuild - they now ship with 0755 instead of 0644. Is this an intentional change in rpm 6.1, or a regression in 'rpmbuild'? more similar issue filled like this bug or https://bugzilla.redhat.com/show_bug.cgi?id=2513497 if its intentional - I would fill a bug for the rest what I have found...
just found regression in file, that probably cause this: https://bugzilla.redhat.com/show_bug.cgi?id=2513643 brp-mangle-shebangs (redhat-rpm-config) uses `file --mime-type` and greps for "text/" https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/rawhide/f/brp-mangle-shebangs#_77 file 5.46 (F44): .service -> text/plain [OK, brp catches it] file 5.47 (F45): .service -> application/x-wine-extension-ini [brp skips it]
Uhh, okay so yes, brp-mangle-shebangs from redhat-rpm-config can and will remove executable permissions from files that do not have a usable shebang. I didn't even know that. Explicitly installing the files with 0755 permissions and expecting 0644 instead seems bizarre to me. Install with the permissions you want, instead of side-effects relying on fragile file classification.
Thanks for all this context. GRUB sets these as 0755 which is wrong (but before these were change to 0644 by redhat-rm-config), so the fix is just about setting these to 0644 explicitly if I am not wrong.
@lsandova yes, better to have 'install -p -m644' in spec
this is fixed in grub2-2.12-76.fc45