From owner-freebsd-pkgbase@freebsd.org Mon Dec 4 18:59:58 2017 Return-Path: Delivered-To: freebsd-pkgbase@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E8E0BE6822F for ; Mon, 4 Dec 2017 18:59:58 +0000 (UTC) (envelope-from gjb@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [96.47.72.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "freefall.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id C51C174F3C; Mon, 4 Dec 2017 18:59:58 +0000 (UTC) (envelope-from gjb@FreeBSD.org) Received: from FreeBSD.org (freefall.freebsd.org [IPv6:2610:1c1:1:6074::16:84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by freefall.freebsd.org (Postfix) with ESMTPS id D566B1F94E; Mon, 4 Dec 2017 18:59:57 +0000 (UTC) (envelope-from gjb@FreeBSD.org) Date: Mon, 4 Dec 2017 18:59:56 +0000 From: Glen Barber To: "Rodney W. Grimes" Cc: Kris Moore , freebsd-pkgbase@freebsd.org Subject: Re: Recent issue with pkg base missing setuid Message-ID: <20171204185956.GH22326@FreeBSD.org> References: <20171204183703.GG22326@FreeBSD.org> <201712041846.vB4IkuiW047326@pdx.rh.CN85.dnsmgr.net> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="EDJsL2R9iCFAt7IV" Content-Disposition: inline In-Reply-To: <201712041846.vB4IkuiW047326@pdx.rh.CN85.dnsmgr.net> User-Agent: Mutt/1.9.1 (2017-09-22) X-BeenThere: freebsd-pkgbase@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: "Packaging the FreeBSD base system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Dec 2017 18:59:59 -0000 --EDJsL2R9iCFAt7IV Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Dec 04, 2017 at 10:46:56AM -0800, Rodney W. Grimes wrote: > > On Mon, Dec 04, 2017 at 12:46:37PM -0500, Kris Moore wrote: > > > On 12/04/2017 11:37, Brad Davis wrote: > > > > On Mon, Dec 4, 2017, at 09:25 AM, Kris Moore wrote: > > > >> Anybody else noticed a recent regression (say past month or so) wh= ere > > > >> pkg base of latest HEAD is now failing to throw setuid on some fil= es? We > > > >> saw it at first because /sbin/shutdown lost its setuid bit, so use= rs > > > >> can't shutdown the box. I rolled back pkg to 1.10.1 which was work= ing, > > > >> and that didn't seem to make a difference. Now I suspect something= in > > > >> HEAD itself changed, but for the life of me can't find where. > > > > Hey Kris, > > > > > > > > Can you look at the plist file and see if it is correctly flagging = the > > > > file there? > > > > > > > > > > > > Regards, > > > > Brad Davis > > > > _______________________________________________ > > > > freebsd-pkgbase@freebsd.org mailing list > > > > https://lists.freebsd.org/mailman/listinfo/freebsd-pkgbase > > > > To unsubscribe, send any mail to "freebsd-pkgbase-unsubscribe@freeb= sd.org" > > >=20 > > > Here's what I have in the plist: > > >=20 > > > @(root,operator,04554,) /sbin/shutdown > > >=20 > > > I'll note that ping/ping6 also have similar, and they install setuid > > > properly: > > >=20 > > > @(root,wheel,04555,) /sbin/ping > > > @(root,wheel,04555,) /sbin/ping6 > > >=20 > > > Here's what I have in the pkg tarball: > > >=20 > > > # tar tvf FreeBSD-runtime-12.0.s20171204170123.txz | grep shutdown > > > hr-sr-xr-- 0 root operator 0 Dec 4 17:05 /sbin/shutdown link = to > > > /sbin/poweroff > > >=20 > > > # tar tvf FreeBSD-runtime-12.0.s20171204170123.txz | grep poweroff > > > -r-xr-xr-- 0 root wheel 15440 Dec 4 17:05 /sbin/poweroff > > > hr-sr-xr-- 0 root operator 0 Dec 4 17:05 /sbin/shutdown link = to > > > /sbin/poweroff > > >=20 > > >=20 > > > And installing it again sure enough gives version without setuid: > > >=20 > > > # pkg-static add -f FreeBSD-runtime-12.0.s20171204170123.txz > > > Installing FreeBSD-runtime-12.0.s20171204170123... > > > package FreeBSD-runtime is already installed, forced install > > > Extracting FreeBSD-runtime-12.0.s20171204170123: 100% > > >=20 > > > [root@chimera] > > > /usr/obj/usr/src/repo/FreeBSD:12:amd64/12.0.s20171204170123# ls -al > > > /sbin/shutdown > > > -r-xr-xr-- 2 root wheel 15440 Dec 4 17:05 /sbin/shutdown > > >=20 > >=20 > > I think this is the problem. I believe /sbin/poweroff should be a hard > > link to /sbin/shutdown. Meaning, the links are reversed, so the setuid > > bit is lost because poweroff is not installed with the setuid bit. > >=20 > > The only thing I can think of so far is r325859, which sorts the METALOG > > to ensure metadata reproducibility. > >=20 > > Glen > >=20 >=20 > I do not believe that order is at issue here at all, or it shouldnt be, > once the files are hardlinked any chown/chmod effects the one inode > used by both files. >=20 It does appear to be the problem, because the files are packaged alphabetically now. In a repository from September, I see: % tar tvf FreeBSD-runtime-12.0*.txz | grep -E '/sbin/(poweroff|shutdown)' -r-sr-xr-- 0 root operator 15864 Sep 27 15:40 /sbin/shutdown hr-xr-xr-- 0 root wheel 0 Sep 27 15:40 /sbin/poweroff link to /s= bin/shutdown In a more recent repository, I see: % tar tvf FreeBSD-runtime-12.0*.txz | grep -E '/sbin/(poweroff|shutdown)' -r-xr-xr-- 0 root wheel 15864 Nov 15 15:28 /sbin/poweroff hr-sr-xr-- 0 root operator 0 Nov 15 15:28 /sbin/shutdown link to /s= bin/poweroff Glen --EDJsL2R9iCFAt7IV Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEjRJAPC5sqwhs9k2jAxRYpUeP4pMFAlolmywACgkQAxRYpUeP 4pNEyRAAnrHPyT1dxYwik6Z8om7PxAOmS03kiUpeUcvLmJRIeT2MWYI5Z2Zz/zT8 5e8NIcFCiDRBqgZ0Z1HHn4jXZ9d5crxBhZ61Lv2lzkhSev/xkgrwjNcUHOFzDSgk eSu7CJIUue8pDHbF91PcQZNhFnucO71B4NRgRVdl6vAiJycBniGbQqyy4nmEWceQ jPyV30VtmX/M6EOpOM36qyfplb4m/E/MrHmnY/7xThpdWG+E832G3/bM0UcuDqe3 VTS3enGZfNIA1TdzCJ/+FVquLERkan73fzT+kFWr7I9QsP7Q0eME8p19yYgWKeMY reoA02rP9eK0DmGZHtfalHJgkwFlpgLd4oONJLQiyChv7vgVX1UdENFkNUFLplAW EsFtyYbh0l8bEibZvLu6gypY4gTtBOO69k5FlPkXpc5rYHuUrxPihz4GJzbsHFOO SJQNcvVARI9vMbgkkrwxAxRkK+cbWql03zQSODjpCbUzEIjbTGlRNi2gJUEa86Fu jwMRLz/ewveVfRYW9rKdIPfZHJCyCbI8ZUtgKxD4j2a7haNO/yN7a0Y4o8Dx7cdY Xnxe6ivZ3kpjibnEUQHEUFCT7bsynQDNp985O8S4vgOgPXmaBLg/V8zQ7KHsbuL4 jIu3esDIch4Zj8A7nqSwSl4XuaagBz19Qu13+xiZ7ZpGKNuCyl0= =zEA8 -----END PGP SIGNATURE----- --EDJsL2R9iCFAt7IV--