debpkg icon indicating copy to clipboard operation
debpkg copied to clipboard

Add permissions/ownership to files/folders from config-file

Open rikvdh opened this issue 8 years ago • 4 comments

rikvdh avatar Aug 23 '17 06:08 rikvdh

This must be left to the package builder with postinst. Read https://www.debian.org/doc/debian-policy/ch-files.html#s-permissions-owners

Only we must force:

Files should be owned by root:root, and made writable only by the owner and universally readable (and executable, if appropriate), that is mode 644 or 755.

Directories should be mode 755 or (for group-writability) mode 2775. The ownership of the directory should be consistent with its mode: if a directory is mode 2775, it should be owned by the group that needs write access to it. [98]

Control information files should be owned by root:root and either mode 644 (for most files) or mode 755 (for executables such as maintainer scripts).

Setuid and setgid executables should be mode 4755 or 2755 respectively, and owned by the appropriate user or group. They should not be made unreadable (modes like 4711 or 2711 or even 4111); doing so achieves no extra security, because anyone can find the binary in the freely available Debian package; it is merely inconvenient. For the same reason you should not restrict read or execute permissions on non-set-id executables.

xor-gate avatar Aug 23 '17 09:08 xor-gate