(security) file ownership in liblockfile1 1.01 (fwd)

[andy <dovienya@interzone.org>]

i sent this off to the security mailing list...  the permissions problem
is apparently sparc specific.
-- begin reply --
On Wed, 11 Oct 2000, Daniel Jacobowitz wrote:
-rwxr-sr-x buildd/mail   14228 1999-07-19 10:57:34 usr/bin/dotlockfile

There's the problem.

[...]

This sort of error happens when building the package.  It needs to be
recompiled for sparc.  I'll try to get it in 2.2r1.
-- end reply --

the original problem description is included below...

	andy

---------- Forwarded message ----------
Date: Wed, 11 Oct 2000 07:18:23 -0700 (PDT)
From: andy <dovienya@interzone.org>
To: debian-security@lists.debian.org
Subject: file ownership in liblockfile1 1.01 (sparc)
Resent-Date: Wed, 11 Oct 2000 07:18:31 -0700
Resent-From: debian-security@lists.debian.org

just ran tiger on a fresh debian (2.2) install, and received the following
warnings:

# Performing check of PATH components...
# Only checking user 'root'
--WARN-- [path002w] /usr/bin/dotlockfile in root's PATH from default is
not owned by root (owned by dovienya).

--WARN-- [xxxxx] The following files have undefined groups ownership:
/usr/doc/liblockfile1/changelog.gz
/usr/doc/liblockfile1/copyright
/usr/lib/liblockfile.so.1
/usr/lib/liblockfile.so.1.0
/usr/man/man1/dotlockfile.1
/var/lib/dpkg/info/liblockfile1.postinst
/var/lib/dpkg/info/liblockfile1.shlibs

and sure enough...

-rwxr-sr-x    1 dovienya mail /usr/bin/dotlockfile
-rw-r--r--    1 root     500  /usr/doc/liblockfile1/changelog.gz
-rw-r--r--    1 root     500  /usr/doc/liblockfile1/copyright
lrwxrwxrwx    1 root     root /usr/lib/liblockfile.so.1 ->
liblockfile.so.1.0
-rw-r--r--    1 root     500  /usr/lib/liblockfile.so.1.0
-rw-r--r--    1 root     500  /usr/man/man1/dotlockfile.1
-rwxr-xr-x    1 root     500  /var/lib/dpkg/info/liblockfile1.postinst
-rwxr-xr-x    1 root     500  /var/lib/dpkg/info/liblockfile1.shlibs

i verified that the same holds true on two other installs, and didn't find
any information on this on the net at large...  so i thought i'd send an
email out debian-security way to get some feedback...

thanks!

	andy


--  
To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org