mainSavannah Administration - Support: sr #110993, Cvs.pm: bad cvs permission setup

 
 

sr #110993: Cvs.pm: bad cvs permission setup

Submitter:  Jing Luo <jing>
Submitted:  Tue 26 Dec 2023 01:00:52 PM UTC
   
 
Category:  Savane Priority:  5 - Normal
Severity:  5 - Blocker Status:  Done
Privacy:  Public Assigned to:  ineiev
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 27 Dec 2023 04:24:28 PM UTC, comment #1: 

Thank you, I left the command without the -R.

Ineiev <ineiev>
Site Administrator
Tue 26 Dec 2023 01:00:52 PM UTC, original submission:  

Hi,

Cvs.pm has one line in sub setup_cvs_permissions:

  # Seal CVSROOT dir; 2775 on the top dir allows group members
  # with local access to rename CVSROOT and replace it with
  # their own.
  system ('chmod', '-R', 'a-w', "$dir_cvs/CVSROOT/");

This will cause the CVSROOT to be read only, effectively cancelling all previous permission setup. The symptom includes cvs history not writable when committing:

> cvs commit: warning: cannot open history file `$dir_cvs/CVSROOT/history' for write: Permission denied


The comment mentions "2775 on the top dir allows group members with local access to rename CVSROOT and replace it with their own", which is not true, because we already have this in sub make_cvs_directory:

  # Make the CVSROOT ro for anybody; doing otherwise is a major security hole:
  # ancient versions of pserver, if ran as root, can be set to give root
  # access using the CVSROOT/passwd file; you also basically give local
  # access if you allow people to modify the hooks.
  system ('chown', '-R', 'root:root', "$dir_cvs/CVSROOT");
  system ('chmod', '755', "$dir_cvs/CVSROOT");

So, the solution would be either delete the line "system ('chmod', '-R', 'a-w', "$dir_cvs/CVSROOT/");" completely, or remove "-R" option.

Jing Luo <jing>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by jing (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-12-27 ineiev Open/ClosedOpen Closed
    2023-12-27 ineiev StatusNone Done
        Assigned toNone ineiev

    Back to the top

    Powered by Savane 3.13-04b1.
    Corresponding source code