Bug 1216756 - AUDIT-FIND: shadowsocks-libev: Recursive chown in user owned directory
Summary: AUDIT-FIND: shadowsocks-libev: Recursive chown in user owned directory
Status: NEW
Alias: None
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/383671/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-10-31 14:39 UTC by Johannes Segitz
Modified: 2024-04-19 10:05 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2023-10-31 14:39:00 UTC 
A recent change in shadowsocks-libev introduced:
162 %post
163 %service_add_post %{name}-server.service
164 %service_add_post %{name}-client.service                                                                                                                                                                                                                                                          165 %service_add_post %{name}-manager.service
166 %service_add_post %{name}-nat.service
167 %service_add_post %{name}-redir.service
168 %service_add_post %{name}-tunnel.service
169 %service_add_post %{name}-server@.service
170 %service_add_post %{name}-client@.service
171 %service_add_post %{name}-nat@.service
172 %service_add_post %{name}-redir@.service
173 %service_add_post %{name}-tunnel@.service
174 chown root:shadowsocks %{_sysconfdir}/shadowsocks -R

This is not great from a security POV and I also fail to see why we do this. The group just has read permissions, but the shadowsocks-libev-config.json file in there has 644 anyway, so I doesn't really help. Can we drop this?
Comment 1 Johannes Segitz 2023-10-31 14:39:17 UTC 
can't assign it to the openSUSE contributor, sent him a mail
Comment 2 Matthias Gerstner 2023-11-02 10:33:10 UTC 
Side note: this might be the result of an attempt to fix bug 1212862.