Skip to content

main/postmarketos-base: fix file permissions of /etc/sudoers

Administrator requested to merge fix-sudoers into master

Thanks to @Minecrell for the patch! Merging after CI passes and backporting to v21.06, since this is a security fix. As written below, it shouldn't have practical impact, but still let's fix it up.

main/postmarketos-base: fix file permissions of /etc/sudoers

Installing postmarketos-base currently changes the file permissions
of /etc/sudoers:

  # apk add sudo
  # stat /etc/sudoers
  Access: (0440/-r--r-----)  Uid: (    0/    root)   Gid: (    0/    root)

  # apk add postmarketos-base
  # stat /etc/sudoers
  Access: (0044/----r--r--)  Uid: (    0/    root)   Gid: (    0/    root)

The file mode 0044 decodes to:
  - User *cannot* read
  - Group can read
  - Other can read

which does not make any sense. The "sudoers" man page makes it very
clear that this file should have a file mode of 0440 [1]
("readable by owner and group, writable by none").

This looks like a bad typo. However, given that only read permissions
were given out this shouldn't have major security implications
(except allowing all users to see who can use sudo).
Install the file with 0440 instead of 0044 to fix this:

  # apk add postmarketos-base
  # stat /etc/sudoers
  Access: (0440/-r--r-----)  Uid: (    0/    root)   Gid: (    0/    root)

[1]: https://www.sudo.ws/man/1.9.8/sudoers.man.html#Error_log_entries

Merge request reports