[Tracker-discuss] file permissions on psf:~roundup/trackers/tracker/*

[Roché Compaan]

On Thu, 2006-11-23 at 10:20 -0500, Stefan Seefeld wrote:
> Izak Burger wrote:
> > Stefan Seefeld wrote:
> >> OK. Shouldn't they be group-writable ? What would happen if I tried to
> >> modify them by mail, i.e. by means of ronudup-mailgw, invoked through
> >> exim or some other MTA ?
> > 
> > If an issue is created using the web, it will end up with permissions
> > 644, owned by www-data, group roundup.  That is a problem.  If you later
> > try to modify this file as the roundup user it will fail.  As far as I
> > know roundup-mailgw does not delete or modify files, so it shouldn't be
> > a problem.  But if you run roundup-admin (like you did) it might cause
> > problems (which it did :-) ).
> 
> I think at least theoretically roundup-mailgw should be able to do
> *anything* that can be done through the web, too. I'm not sure whether
> there are actual commands embeddable into the mail subject line to
> delete or modify files in the db, but they easily could.

roundup-mailgw *can* do anything that can be done through the web and
vice verse, but only if the file permissions are *group writable*. This
is often misconfigured. And realize that directories are not created
where the group has write permissions by default. Even if you set the
sticky bit on the group write permission, subdirectories are created
without the group write permission set.

A system wide umask to make all directories group writable by default is
not an acceptable solution.

The roundup codebase has to create directories where the group can write
to it, or everything has to run under the same user. At this point I'm
going to support Izak's recommendation to run Apache as the roundup user
so that we can put an end to the permission problems.

-- 
Roché Compaan
Upfront Systems                   http://www.upfrontsystems.co.za