From 41db5a756369f5b14d1e67a523ee0940cad56744 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= Date: Tue, 30 May 2017 17:40:39 +0200 Subject: [PATCH] activation: Change permissions on /root to #o700. Reported by Alex Griffin . Fixes . * gnu/build/activation.scm (add-user): When UID is zero, add 'chmod' call. * gnu/tests/base.scm (run-basic-test)["permissions on /root"]: New test. --- gnu/build/activation.scm | 5 +++-- gnu/tests/base.scm | 9 +++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/gnu/build/activation.scm b/gnu/build/activation.scm index a1d2a9cc7d..299c0728cb 100644 --- a/gnu/build/activation.scm +++ b/gnu/build/activation.scm @@ -130,14 +130,15 @@ (define* (add-user name group ;; 'useradd' fails with "Cannot determine your user name" if the root ;; account doesn't exist. Thus, for bootstrapping purposes, create that ;; one manually. - (begin + (let ((home (or home "/root"))) (call-with-output-file "/etc/shadow" (cut format <> "~a::::::::~%" name)) (call-with-output-file "/etc/passwd" (cut format <> "~a:x:~a:~a:~a:~a:~a~%" name "0" "0" comment home shell)) (chmod "/etc/shadow" #o600) - (copy-account-skeletons (or home "/root")) + (copy-account-skeletons home) + (chmod home #o700) #t) ;; Use 'useradd' from the Shadow package. diff --git a/gnu/tests/base.scm b/gnu/tests/base.scm index e5ac320b74..f5bbfafee3 100644 --- a/gnu/tests/base.scm +++ b/gnu/tests/base.scm @@ -199,6 +199,15 @@ (define (user-owned? file) ',users+homes)) marionette))) + (test-equal "permissions on /root" + #o700 + (let ((root-home #$(any (lambda (account) + (and (zero? (user-account-uid account)) + (user-account-home-directory + account))) + (operating-system-user-accounts os)))) + (stat:perms (marionette-eval `(stat ,root-home) marionette)))) + (test-equal "no extra home directories" '()