/usr/local/tce.* ownership and perms

[Jason W]

All existing extensions that have a tce.installed directory have had their permissions set to root:staff/775 for those that did not have that perm already.  I checked for tce.installed, but those that were fixed had their tce.menu and tce.icons directory set though they are not as critical.

[jpeters]

All existing extensions that have a tce.installed directory have had their permissions set to root:staff/775 for those that did not have that perm already.  I checked for tce.installed, but those that were fixed had their tce.menu and tce.icons directory set though they are not as critical.

Just noticed the permission change for /tce.installed.; used to need tc:staff, I think.  

[Jason W]

Yeah, tc:staff was widely used and in and of itself would not cause a problem though root:staff is what has been settled on.  Group staff and 775 perms are the critical details.

[jpeters]

Looks like the issue of extensions changing tce.installed to root:root has been resolved ??

[Jason W]

Yes, with the above permissions set on all existing extensions' tce.installed directory there should be no more permissions issue with any version of TC 2.x.  If extensions in anyone's existing tce directory are causing issue, redownload and all should be well.  There should be no extensions now that will cause a root:root tce.installed, but of course if there are any they can be mentioned here.  But I think I got them all, 102 were fixed.

[jpeters]

Yes, with the above permissions set on all existing extensions' tce.installed directory there should be no more permissions issue with any version of TC 2.x.  If extensions in anyone's existing tce directory are causing issue, redownload and all should be well.  There should be no extensions now that will cause a root:root tce.installed, but of course if there are any they can be mentioned here.  But I think I got them all, 102 were fixed.

Looks like the vulnerability was fixed as well. I created xonclock-test while in root, and loaded -i -r (I think that changed /tce.installed to root:root previously). Despite the error message, permissions remain, xonclock is in /tce.installed,  and xonclock works.

Code: [Select]


tc@box:~$ ls -ld /usr/local/tce.installed/
drwxr-xr-x    2 root     staff         960 Oct 18 07:00 /usr/local/tce.installed//
tc@box:~$ tce-load -i -r /tmp/xonclock-test.tcz 
xonclock-test.tcz
touch: /usr/local/tce.installed/xonclock-test: Permission denied
tc@box:~$ ls -ld /usr/local/tce.installed/
drwxr-xr-x    2 root     staff         980 Oct 18 07:01 /usr/local/tce.installed//
tc@box:~$ find /usr/local/tce.installed/xonclock
/usr/local/tce.installed/xonclock
tc@box:~$


[jpeters]

Something's still weird. Sometimes command line installs aren't getting into /tce.installed, other times they are.  This example shows the files installed, the extension loaded to my tce dir, but no listing in
/tce.installed.  I tried the same with xonclock, and it was fine. Last time I tried with actkbd, it wasn't in my tce directory either, although the files were present.  
 

Code: [Select]

tc@box:~$ tce-load -i -w actkbd.tcz
actkbd.tcz: OK
touch: /usr/local/tce.installed/actkbd: Permission denied
tc@box:~$ find /usr/local/tce.installed/actkbd
find: /usr/local/tce.installed/actkbd: No such file or directory
tc@box:~$ find /usr/local/sbin/actkbd
/usr/local/sbin/actkbd
tc@box:~$ find /mnt/hda1/tcZ2/actkbd.tcz
/mnt/hda1/tcZ2/actkbd.tcz


[Jason W]

jpeters - is that using either an empty tce directory or a fresh boot with "base norestore"?

[jpeters]

jpeters - is that using either an empty tce directory or a fresh boot with "base norestore"?

neither

[Jason W]

Ok, that means that there are some extensions in your tce directory that have not been fixed. 

Running the extension audit script on your tce directory will tell you which are the offending extensions

[jpeters]

Ok, that means that there are some extensions in your tce directory that have not been fixed.  

Running the extension audit script on your tce directory will tell you which are the offending extensions

That will affect a new install ??  

[Jason W]

The script will simply point out any extensions with bad perms on tce.installed. 

Are the extensions in your tce directory installed in the last 12 hours or so? 

[jpeters]

The script will simply point out any extensions with bad perms on tce.installed.  

Are the extensions in your tce directory installed in the last 12 hours or so?  

Check the example posted.

Note: I'll try the audit script again with a full base boot ....it doesn't work with the group presently loaded.  

[jpeters]

Okay, it's installing now. Script works fine with full base.   

[Jason W]

I will adjust the audit script to not exit but just echo an error message so it will display all extension issues in one run.  That would help for things like this.

EDIT: script fixed.