Bug 32541 - why not make /etc/default/ readble by all?
Summary: why not make /etc/default/ readble by all?
Status: CLOSED FIXED
Alias: None
Product: Sisyphus
Classification: Development
Component: shadow-utils (show other bugs)
Version: unstable
Hardware: all Linux
: P3 enhancement
Assignee: Mikhail Efremov
QA Contact: qa-sisyphus
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-09-28 11:38 MSK by Ivan Zakharyaschev
Modified: 2017-03-07 20:23 MSK (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ivan Zakharyaschev 2016-09-28 11:38:26 MSK 
shadow-utils-4.1.4.2-alt8


$ rpm -qf /etc/default -lv | fgrep /etc/default
drwxr-x--x    2 root    root                0 июн 21  2012 /etc/default
-rw-------    1 root    root              118 июн 21  2012 /etc/default/useradd
$ 

Why should the list of things that are in the directory be secret?


$ egrep '^/etc/default' /ALT/Sisyphus/{noarch,x86_64}/base/contents_index
/ALT/Sisyphus/noarch/base/contents_index:/etc/default/eeepc-acpi-scripts	eeepc-acpi-scripts
/ALT/Sisyphus/noarch/base/contents_index:/etc/default/google-chrome	google-chrome-preinstall
/ALT/Sisyphus/noarch/base/contents_index:/etc/default/jetty	jetty
/ALT/Sisyphus/noarch/base/contents_index:/etc/default/vivaldi	vivaldi-preinstall
/ALT/Sisyphus/noarch/base/contents_index:/etc/default/yandex-browser	yandex-browser-preinstall
/ALT/Sisyphus/noarch/base/contents_index:/etc/default/yandex-browser-beta	yandex-browser-preinstall
/ALT/Sisyphus/x86_64/base/contents_index:/etc/default	shadow-utils
/ALT/Sisyphus/x86_64/base/contents_index:/etc/default/aufs	aufs2-util
/ALT/Sisyphus/x86_64/base/contents_index:/etc/default/aufs	aufs2-util-ng
/ALT/Sisyphus/x86_64/base/contents_index:/etc/default/aufs	aufs3-util
/ALT/Sisyphus/x86_64/base/contents_index:/etc/default/cryptmount	cryptmount
/ALT/Sisyphus/x86_64/base/contents_index:/etc/default/grub	grub2-common
/ALT/Sisyphus/x86_64/base/contents_index:/etc/default/ld10k1	/etc/default/ld10k1
/ALT/Sisyphus/x86_64/base/contents_index:/etc/default/ltsp-client-setup	ltsp-client
/ALT/Sisyphus/x86_64/base/contents_index:/etc/default/useradd	shadow-utils
/ALT/Sisyphus/x86_64/base/contents_index:/etc/default/vservers-default	util-vserver
$ 

Are there plans for /etc/default/ to hold some files with secret names?
Comment 1 Ivan Zakharyaschev 2016-09-28 11:58:13 MSK 
In Ubuntu Trusty, it's readable by all.
Comment 2 Repository Robot 2017-03-07 20:23:37 MSK 
shadow-1:4.4-alt1 -> sisyphus:

* Fri Mar 03 2017 Mikhail Efremov <sem@altlinux> 1:4.4-alt1
- Don't own %_sysconfdir/default/ (closes: #32541).
- Fix possible crash if gmtime() returns NULL.
- chsh: Fix duplicate warning.
- Enable audit support.
- Don't package ChangeLog/NEWS files.
- Spec cleanup.
- submap: Add control scripts for newuidmap/newgidmap.
- Fix build: ignore write() return value.
- configure.ac: Drop man/po/Makefile.
- Drop FORCE_SHADOW.
- Don't create missing files.
- Fixes from usptream git:
  + Keep the permissions of the original file when creating a backup.
  + useradd: Read defaults after changing root directories.
  + Don't crash on bogus keys in login.defs if PAM is enabled.
  + Last bits of enabling subuids.
  + Make login.def files valid ASCII instead of UTF-8.
  + include getdef.h for getdef_bool prototype.
  + Print error message if SELinux file context manipulation fails.
  + Fix regression in useradd not loading defaults properly.
  + */Makefile.am: Replace INCLUDES with AM_CPPFLAGS.
- Updated to 4.4 (fixes CVE-2016-6252).