Re: [PATCH 01/20] scripts/make-erofs.sh: Ensure that / is world-readable

[Alyssa Ross <hi@alyssa.is>]

[-- Attachment #1: Type: text/plain, Size: 1739 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> Previously it had 0700 permissions, which was hidden because everything
> ran as root anyway.  However, dbus-broker fails to start in this case
> because it always drops privileges.  Also set umask to 0022 to ensure
> that the permissions of other directories are correct.
>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
>  scripts/make-erofs.sh | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/scripts/make-erofs.sh b/scripts/make-erofs.sh
> index b47048ad747bd7dfcc28e0f1dfd75ec090fa7e09..88e3885e578a6fd85a61c6f2993a9addb7f44c37 100755
> --- a/scripts/make-erofs.sh
> +++ b/scripts/make-erofs.sh
> @@ -8,6 +8,7 @@
>  #        single directory structure, and could generate an EROFS image
>  #        based on source:dest mappings directly.
>  
> +umask 0022 # for permissions

The idea being that it might be overly tight otherwise?  Could it be a
separate patch with its own commit message?

>  ex_usage() {
>  	echo "Usage: make-erofs.sh [options]... img < srcdest.txt" >&2
>  	exit 1
> @@ -18,8 +19,12 @@ if [ -z "${img-}" ]; then
>  	ex_usage
>  fi
>  
> -root="$(mktemp -d -- "$img.tmp.XXXXXXXXXX")"
> -trap 'chmod -R +w -- "$root" && rm -rf -- "$root"' EXIT
> +superroot="$(mktemp -d -- "$img.tmp.XXXXXXXXXX")"
> +trap 'chmod -R +w -- "$root" && rm -rf -- "$superroot"' EXIT
> +# $superroot has 0700 permissions, so create a subdirectory
> +# with correct (0755) permissions and do all work there.
> +root=$superroot/real_root
> +mkdir -- "$root"
>  
>  while read -r arg1; do
>  	read -r arg2 || ex_usage
>

I think this change is big enough to justify a copyright header. :)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]