Enforce proper permissions on existing directories (security bug 182998)

Package-Manager: portage-2.1.3.9

4 files changed, 75 insertions, 10 deletions

diff --git a/sys-process/cronbase/ChangeLog b/sys-process/cronbase/ChangeLog
index d98d0a69e57c..283ce04ac42f 100644
--- a/sys-process/cronbase/ChangeLog
+++ b/sys-process/cronbase/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for sys-process/cronbase
-# Copyright 2002-2006 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-process/cronbase/ChangeLog,v 1.19 2006/11/02 22:33:11 bangert Exp $
+# Copyright 2002-2007 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sys-process/cronbase/ChangeLog,v 1.20 2007/09/26 21:36:27 falco Exp $
+
+*cronbase-0.3.2-r1 (26 Sep 2007)
+
+  26 Sep 2007; Raphael Marichez <falco@gentoo.org>
+  +cronbase-0.3.2-r1.ebuild:
+  Enforce proper permissions on existing directories (security bug 182998)
 
   02 Nov 2006; Thilo Bangert <bangert@gentoo.org> -files/README,
   cronbase-0.2.1-r3.ebuild, cronbase-0.3.ebuild, cronbase-0.3.1.ebuild,
diff --git a/sys-process/cronbase/Manifest b/sys-process/cronbase/Manifest
index 0861d5627aec..25e0f02ea20c 100644
--- a/sys-process/cronbase/Manifest
+++ b/sys-process/cronbase/Manifest
@@ -25,6 +25,10 @@ EBUILD cronbase-0.3.1.ebuild 761 RMD160 25fbf107ebc8f6d7e965391259e5a77d9b1deca6
 MD5 62ef36a8c6be9e5fc12b0e205d2c0e0a cronbase-0.3.1.ebuild 761
 RMD160 25fbf107ebc8f6d7e965391259e5a77d9b1deca6 cronbase-0.3.1.ebuild 761
 SHA256 e0bdda77c72c9f076e9ed0480174052661a7c3181df3273d615eb2ee26a8cc0d cronbase-0.3.1.ebuild 761
+EBUILD cronbase-0.3.2-r1.ebuild 1514 RMD160 6aa0e0935ef39e97d2c03e6a6a78d82d1a07f8e5 SHA1 99d9885479b3d837db89157480b48745938882f7 SHA256 4da239cd5c356e33e4162a94c2b70e73697f669fc86ffa7da33e0084f8aca262
+MD5 57ecf27dde841067f9e26faf0e64674f cronbase-0.3.2-r1.ebuild 1514
+RMD160 6aa0e0935ef39e97d2c03e6a6a78d82d1a07f8e5 cronbase-0.3.2-r1.ebuild 1514
+SHA256 4da239cd5c356e33e4162a94c2b70e73697f669fc86ffa7da33e0084f8aca262 cronbase-0.3.2-r1.ebuild 1514
 EBUILD cronbase-0.3.2.ebuild 878 RMD160 bf1b052e1916e01b96a92110d2dbe9a5230bf9d4 SHA1 d9a169b71b2a7b782e5b0b6f5fd2edd0395337da SHA256 0e979391efe9455c94b4d02889b2e7d436fcd4ca4aee32e4dcb469896b743e86
 MD5 be635efe88a6397d197dc37e6b93a2e7 cronbase-0.3.2.ebuild 878
 RMD160 bf1b052e1916e01b96a92110d2dbe9a5230bf9d4 cronbase-0.3.2.ebuild 878
@@ -33,10 +37,10 @@ EBUILD cronbase-0.3.ebuild 768 RMD160 fc36b9d4950b995f38f8c5d57a44ce9a553c0341 S
 MD5 4b9cd347f8f4d8ef60eaab7ed9c8fafa cronbase-0.3.ebuild 768
 RMD160 fc36b9d4950b995f38f8c5d57a44ce9a553c0341 cronbase-0.3.ebuild 768
 SHA256 6c8cb34fc079f7c4fbc5d5ecdd258a3eaf4e3d84cb2b28640744b226f1fccc3d cronbase-0.3.ebuild 768
-MISC ChangeLog 5839 RMD160 25e05e0df6e33c17f19cdd914df16e3945e7d72d SHA1 1a7a28536f5ca2c1334ae176d35588437b821408 SHA256 117740cd79a047ad2904d6089e7ec3297ee7da6c99c2bc1fcc8e9b6535a190dc
-MD5 3a0590afa300080fe7dcebabcbffdab9 ChangeLog 5839
-RMD160 25e05e0df6e33c17f19cdd914df16e3945e7d72d ChangeLog 5839
-SHA256 117740cd79a047ad2904d6089e7ec3297ee7da6c99c2bc1fcc8e9b6535a190dc ChangeLog 5839
+MISC ChangeLog 6027 RMD160 9fbcb4531c8fbbf86e90154a8e1d7c5abc0b686c SHA1 bdbdcc1a9505df00c46f8b18a0168aff3b4831fb SHA256 7f416212668746f41c02d476ac6583b69919bb398db435a8777f5cd1d7350f81
+MD5 d2a378a3eef8a7f24861921c8de864f0 ChangeLog 6027
+RMD160 9fbcb4531c8fbbf86e90154a8e1d7c5abc0b686c ChangeLog 6027
+SHA256 7f416212668746f41c02d476ac6583b69919bb398db435a8777f5cd1d7350f81 ChangeLog 6027
 MISC metadata.xml 158 RMD160 298878d8b5da225547b337739a1a48192546d7b8 SHA1 5a9f7a1c9f0f56d1b0e72ee9b67b5cc5771f6d7d SHA256 a262a73b2049a89ab6a4bdf51df27bea44c7f0aa0ee33176c59a9c63eb45e764
 MD5 9c8fdf815ce980c230d763b496d4d088 metadata.xml 158
 RMD160 298878d8b5da225547b337739a1a48192546d7b8 metadata.xml 158
@@ -53,10 +57,17 @@ SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b files/di
 MD5 68b329da9893e34099c7d8ad5cb9c940 files/digest-cronbase-0.3.2 1
 RMD160 c0da025038ed83c687ddc430da9846ecb97f3998 files/digest-cronbase-0.3.2 1
 SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b files/digest-cronbase-0.3.2 1
+MD5 d41d8cd98f00b204e9800998ecf8427e files/digest-cronbase-0.3.2-r1 0
+RMD160 9c1185a5c5e9fc54612808977ee8f548b2258d31 files/digest-cronbase-0.3.2-r1 0
+SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 files/digest-cronbase-0.3.2-r1 0
 -----BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.4 (GNU/Linux)
+Version: GnuPG v1.4.7 (GNU/Linux)
 
-iD8DBQFGftLXp/wUKkr7RBoRAtI9AJ4wp6ekFf4JmhEU7TL97sNZpjmvpQCgiqnw
-rmZb7xRGTVW5wXWV0hewR/k=
-=DyMN
+iQEVAwUBRvrQ4TvRww8BFPxFAQLRqQf/a/DW8LYlwgJT/FW9OGPiDC6taOneDX3v
+X64/QuMFcYvjvHZ0g2gXG5SmIYmxPFQIfQrPskkUzDwEqNLxVNysN/ylszXpaU23
+bjgFQsBov8rjozmRYf5fQzP9yxV7Ff4f3qX8sEQKTxry3kZp7Y7ddEyuc9gVyqay
+ehSBIOUD6vd3OGgYR6jbCzV6ICnVTZTC48idOIo5u7N14PIX49L1xuBb3y31HyRy
+R70h4c8VffNgKI1Y4SJLnrrd1gOVYPHD65dCJ+SWJMglHM/i8Fngco6etBtelvsn
+MZlycaywhokECv/kqyxTcrAM+gRvrx0jnOPI2xRGXp74wUbnZcD/uw==
+=reSE
 -----END PGP SIGNATURE-----
diff --git a/sys-process/cronbase/cronbase-0.3.2-r1.ebuild b/sys-process/cronbase/cronbase-0.3.2-r1.ebuild
new file mode 100644
index 000000000000..b72dffc58a6a
--- /dev/null
+++ b/sys-process/cronbase/cronbase-0.3.2-r1.ebuild
@@ -0,0 +1,48 @@
+# Copyright 1999-2007 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-process/cronbase/cronbase-0.3.2-r1.ebuild,v 1.1 2007/09/26 21:36:27 falco Exp $
+
+inherit eutils
+
+DESCRIPTION="base for all cron ebuilds"
+HOMEPAGE="http://www.gentoo.org/"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~sparc-fbsd ~x86 ~x86-fbsd"
+IUSE=""
+
+pkg_setup() {
+	enewgroup cron 16
+	enewuser cron 16 -1 /var/spool/cron cron
+}
+
+src_install() {
+	newsbin "${FILESDIR}"/run-crons-${PV} run-crons || die
+
+	diropts -m0750; keepdir /etc/cron.hourly
+	diropts -m0750; keepdir /etc/cron.daily
+	diropts -m0750; keepdir /etc/cron.weekly
+	diropts -m0750; keepdir /etc/cron.monthly
+
+	diropts -m0750 -o root -g cron; keepdir /var/spool/cron
+
+	diropts -m0750; keepdir /var/spool/cron/lastrun
+}
+
+pkg_postinst() {
+	if has_version '<sys-process/cronbase-0.3.2-r1' ; then
+		echo
+		elog "Previous ebuilds didn't enforce proper permissions on already"
+		elog "existing directories. Appropriate permissions are now being set on"
+		elog "${ROOT}/etc/cron.{hourly,daily,weekly,monthly},"
+		elog "${ROOT}/var/spool/cron/ and ${ROOT}/var/spool/cron/lastrun/"
+		elog "(see bug 182998)"
+		echo
+		chmod 0750 "${ROOT}"/etc/cron.{hourly,daily,weekly,monthly} \
+			|| die "chmod failed"
+		chmod 0750 "${ROOT}"/var/spool/{cron,cron/lastrun} || die "chmod failed"
+		chown root:cron "${ROOT}/var/spool/cron" || die "chown failed"
+	fi
+}
+
diff --git a/sys-process/cronbase/files/digest-cronbase-0.3.2-r1 b/sys-process/cronbase/files/digest-cronbase-0.3.2-r1
new file mode 100644
index 000000000000..e69de29bb2d1
--- /dev/null
+++ b/sys-process/cronbase/files/digest-cronbase-0.3.2-r1