Bug 39609 - Group permissions for /var/log/samba || /var/log/docker.log
Group permissions for /var/log/samba || /var/log/docker.log
Status: CLOSED FIXED
Product: UCS Test
Classification: Unclassified
Component: Samba
unspecified
Other Linux
: P5 normal (vote)
: UCS 4.1
Assigned To: Arvid Requate
Daniel Tröder
: interim-2
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2015-10-22 06:38 CEST by Stefan Gohmann
Modified: 2015-11-17 12:12 CET (History)
0 users

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Gohmann univentionstaff 2015-10-22 06:38:25 CEST
The UCS 4.1 test case 26check_logfiles_general fails because the group for the directory is set to root instead of adm. I guess adm and root are valid. 

*** BEGIN *** ['/bin/bash', '26check_logfiles_general'] ***
*** 01_base/26check_logfiles_general *** Sensitive logfiles are not world-readable ***
*** START TIME: 2015-10-21 18:19:36 ***
error 2015-10-21 18:19:37        Expected -d /var/log/samba 0750 root adm, found   Datei: „/var/log/samba“
  Größe: 4096           Blöcke: 8          EA Block: 4096   Verzeichnis
Gerät: ca01h/51713d     Inode: 137936      Verknüpfungen: 3
Zugriff: (0750/drwxr-x---)  Uid: (    0/    root)   Gid: (    0/    root)
Zugriff    : 2015-10-21 18:19:31.535046000 -0400
Modifiziert: 2015-10-21 18:07:08.608000000 -0400
Geändert   : 2015-10-21 18:07:08.608000000 -0400
 Geburt    : -
***Searching for world-readable logfiles:
Some potentially sensitive log files are world-readable:
-rw-r--r-- 1 root docker 4954 Okt 21 18:15 /var/log/docker.log
*** END TIME: 2015-10-21 18:19:37 ***
*** TEST DURATION (H:MM:SS.ms): 0:00:00.625964 ***
*** END *** 1 ***
Comment 1 Arvid Requate univentionstaff 2015-10-22 12:49:24 CEST
Actually the error message is misleading, the test already checks for "root" as alternative and doesn't fail for that reason. I switched the checks to avoid the irritating message.

The real reason for test failure is /var/log/docker.log. But Daniel already fixed that in univention-docker/conffiles/etc/init.d/docker  :

+univention-docker (0.1.0-7) unstable; urgency=low
+
+  * Docker logfile not world readable anymore (Bug #39494).
+
+ -- Daniel Troeder <troeder@univention.de>  Tue, 20 Oct 2015 12:31:06 +0200
Comment 2 Daniel Tröder univentionstaff 2015-10-22 18:34:14 CEST
OK: commit 64729 removes error message in case of root:root for /var/log/samba
OK: commit 64624 already fixed /var/log/docker.log
OK: automatic test 01_base/26check_logfiles_general succeeds after running /etc/init.d/docker [re]start once (which fixes the permissions of the logfile)
Comment 3 Stefan Gohmann univentionstaff 2015-11-17 12:12:34 CET
UCS 4.1 has been released:
 https://docs.software-univention.de/release-notes-4.1-0-en.html
 https://docs.software-univention.de/release-notes-4.1-0-de.html

If this error occurs again, please use "Clone This Bug".