NethServer 6

In nethserver-testing

I will verify this bug, let me for me please

not yet on the server....is it normal

• symlink
• variable
• relative path
  ... Stephane help me cheating :)

writing in .htwritable

data.*

May  5 18:28:16 makako httpd-admin: [ERROR] Nethgui\System\NethPlatform: process on queue `post-process` exited with code 1: /usr/libexec/neth
server/ptrack  -j -s '/var/run/ptrack/59d073999a059bd6b91dc8044de3f131.sock' -d '/var/spool/ptrack/a98664b8fc13de69.dump'  -- /usr/bin/sudo -n
 /sbin/e-smith/signal-event 'ibay-reset-permissions' 'selfos'
May  5 18:28:16 makako httpd-admin: [EXCEPTION] RuntimeException 1405613538: Nethgui\Model\SystemTasks: could not open dump file /var/spool/pt
rack/a98664b8fc13de69.dump (in /usr/share/nethesis/Nethgui/Model/SystemTasks.php:141)

Creating a new ibay:

May  5 18:31:20 makako httpd-admin: [ERROR] Nethgui\System\NethPlatform: process on queue `post-process` exited with code 1: /usr/libexec/nethserver/ptrack  -j -s '/var/run/ptrack/0bf8663198a88da4902f7b8f2f2b295e.sock' -d '/var/spool/ptrack/ebf415e616ff5a0c.dump'  -- /usr/bin/sudo -n /sbin/e-smith/signal-event 'ibay-reset-permissions' 'selfos'
May  5 18:31:20 makako httpd-admin: [EXCEPTION] RuntimeException 1405613538: Nethgui\Model\SystemTasks: could not open dump file /var/spool/ptrack/ebf415e616ff5a0c.dump (in /usr/share/nethesis/Nethgui/Model/SystemTasks.php:141)

errors persist after removing "data.*" from .htwritable

i'm on it, i have installed the rpm

I don't know if it is wanted but when I set the .htwritablepublic

data
data/cache
data/favicons
data/logs
data/sqlite
data/thumbnails

indeed my data/sqlite/selfoss.db gets the good ownership

# getfacl data/sqlite/*
# file: data/sqlite/selfoss.db
# owner: apache
# group: locals
user::rw-
user:apache:rwx            #effective:rw-
group::r-x            #effective:r--
mask::rw-
other::---

but when I set to the .htwritable
public
data

then the ownership now is

# getfacl data/sqlite/*
# file: data/sqlite/selfoss.db
# owner: admin
# group: locals
user::rw-
user:apache:r--
group::r--
mask::r--
other::---

I understood that now we can have some recursively permissions without the need to list all directories ???

i look to directory we have the same problem

with .htwritable like this

public
data
data/cache
data/favicons
data/logs
data/sqlite
data/thumbnails

# getfacl data/sqlite
# file: data/sqlite
# owner: admin
# group: locals
# flags: -s-
user::rwx
user:apache:rwx
group::r-x
mask::rwx
other::---
default:user::rwx
default:user:apache:rwx
default:group::r-x
default:mask::rwx
default:other::---

and if i set the .htwritable to

public
data

i have these permissions

# file: data/sqlite
# owner: admin
# group: locals
# flags: -s-
user::rwx
user:apache:r-x
group::r-x
mask::r-x
other::---
default:user::rwx
default:user:apache:r-x
default:group::r-x
default:mask::r-x
default:other::---

I don't know if it is what you want but clearly it is not what I would want :)

One folder listed as the root folder should be enough for all subdirectories and files, but I agree if you need you could have some exemptions if you want to be able to forbid some directories.

Since stello has seen some errors, do I continue to test ?

1. rpm -qa nethserver-httpd
   nethserver-httpd-2.4.0-1.3.gc38287d.ns6.noarch

rpm -qa nethserver-httpd
nethserver-httpd-2.4.0-1.3.gc38287d.ns6.noarch

• Case : only root folder are listed in /htwritable ---->OK

# cat .htwritable 
public
data

now my db sqlite gets the good ownership

# getfacl data/sqlite/*
# file: data/sqlite/selfoss.db
# owner: apache
# group: locals
user::rw-
user:apache:rwx            #effective:rw-
group::r-x            #effective:r--
mask::rw-
other::---

same for folder inside created after the reset

# file: data/sqlite/toto
# owner: root
# group: locals
# flags: -s-
user::rwx
user:apache:rwx
group::r-x
mask::rwx
other::---
default:user::rwx
default:user:apache:rwx
default:group::r-x
default:mask::rwx
default:other::---

• Case ownership of symlinks ------->OK

mkdir /tmp/tata
touch /tmp/plop
ln -s /tmp/tata data/sqlite/tata
ln -s /tmp/plop data/sqlite/plop

then when I reset

# file: data/sqlite/tata
# owner: root
# group: root
user::rwx
group::r-x
other::r-x

# file: data/sqlite/plop
# owner: root
# group: root
user::rw-
group::r--
other::r--

IF I resume well, now recursively is good and sysmlink are not allowed

How I can test for 'variable' and 'relative path' ?????

How I can test for 'variable' and 'relative path' ?????

No idea ?

For "Relative path" I was thinking about

../../etc/passwd

"Variable", I don't know. The list is passed to setfacl as STDIN data. Shell is not involved.

well to continue previous tests about https://dev.nethserver.org/issues/3139#note-15 I tested now relative path directly in .htwritable

mkdir ../../plop-folder
touch ../../plop

ll ../../
total 24
drwxr-xr-x. 2 root root 4096 May  7 00:15 backup
drwxr-s---. 2 root adm  4096 May  6 10:57 db
drwxr-xr-x. 3 root root 4096 May  6 10:20 home
drwxr-xr-x. 3 root root 4096 May  6 10:22 ibay
-rw-r--r--. 1 root root    0 May 14 09:09 plop
drwxr-xr-x. 2 root root 4096 May 14 09:10 plop-folder
drwxr-xr-x. 2 root root 4096 May  6 10:20 secrets

and look with getfacl

 getfacl ../../plop
# file: ../../plop
# owner: root
# group: root
user::rw-
group::r--
other::r--

  getfacl ../../plop-folder
# file: ../../plop-folder
# owner: root
# group: root
user::rwx
group::r-x
other::r-x

I edit the .htwritable and add

cat .htwritable
public
data
../../plop-folder
../../plop

then I reset permission with the I bay panel

getfacl ../../plop
# file: ../../plop
# owner: root
# group: root
user::rw-
group::r--
other::r--

getfacl ../../plop-folder
# file: ../../plop-folder
# owner: root
# group: root
user::rwx
group::r-x
other::r-x

well it seems ok concerning

files and folder creation, keeps also good ownership after a reset
folder and file link are not allowed to apache
relative link written in .htwritable are also not allowed to apache

===> seems verified, it needs now a textarea :)