diff options
| author | David Kalnischkies <david@kalnischkies.de> | 2017-07-07 22:21:44 +0200 |
|---|---|---|
| committer | David Kalnischkies <david@kalnischkies.de> | 2017-07-26 19:09:04 +0200 |
| commit | 881ec045b6660e2fe0c6953720260e380ceeeb99 (patch) | |
| tree | 231454f60c5d3bd20396444316bf15671a7a5ee7 /apt-pkg | |
| parent | 6291fa81da6ed4c32d0dde33fa559cd155faff11 (diff) | |
allow the auth.conf to be root:root owned
Opening the file before we drop privileges in the methods allows us to
avoid chowning in the acquire main process which can apply to the wrong
file (imagine Binary scoped settings) and surprises users as their
permission setup is overridden.
There are no security benefits as the file is open, so an evil method
could as before read the contents of the file, but it isn't worse than
before and we avoid permission problems in this setup.
Diffstat (limited to 'apt-pkg')
| -rw-r--r-- | apt-pkg/acquire.cc | 15 |
1 files changed, 0 insertions, 15 deletions
diff --git a/apt-pkg/acquire.cc b/apt-pkg/acquire.cc index 5e5e146a8..9272c2402 100644 --- a/apt-pkg/acquire.cc +++ b/apt-pkg/acquire.cc @@ -74,21 +74,6 @@ void pkgAcquire::Initialize() QueueMode = QueueHost; if (strcasecmp(Mode.c_str(),"access") == 0) QueueMode = QueueAccess; - - // chown the auth.conf file as it will be accessed by our methods - std::string const SandboxUser = _config->Find("APT::Sandbox::User"); - if (getuid() == 0 && SandboxUser.empty() == false && SandboxUser != "root") // if we aren't root, we can't chown, so don't try it - { - struct passwd const * const pw = getpwnam(SandboxUser.c_str()); - struct group const * const gr = getgrnam(ROOT_GROUP); - if (pw != NULL && gr != NULL) - { - std::string const AuthConf = _config->FindFile("Dir::Etc::netrc"); - if(AuthConf.empty() == false && RealFileExists(AuthConf) && - chown(AuthConf.c_str(), pw->pw_uid, gr->gr_gid) != 0) - _error->WarningE("SetupAPTPartialDirectory", "chown to %s:root of file %s failed", SandboxUser.c_str(), AuthConf.c_str()); - } - } } /*}}}*/ // Acquire::GetLock - lock directory and prepare for action /*{{{*/ |