From nobody Fri Nov 04 11:05:23 2022 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4N3d841Wv1z4hjyq; Fri, 4 Nov 2022 11:05:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4N3d840hqyz3lYC; Fri, 4 Nov 2022 11:05:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1667559924; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ro4VCFXS5H2CEp++Nq47l0juiEKS/AWKrpoznjFnxLs=; b=cQCQlevn3KESwi1PCisHh26Ii8TgQWOi4aGE+iABFxiXE7h89zsNTnuxuexty1yY8uum8I UCn1QOCE1vKETwZUuQFg5gP3BTPuyHkvxVfQV+CZF1oeQATDcf1NlpB80DJDspGViUzSHn 0Bg98NB7S02dFnN2ZVzjf7dnkR+g8g9Tf1DmtlfQYgj1yY3spgTfHTt3QOghKKhgS9DOj4 hxN4Kg76iiCk5VfUtslHkO36oqYafwdUyrUpZ9TGnGzi13rRMBudN5n7SOYViTG9sxu+eI XcVLrRb9jfoarSxoYpBV9EmQFfIW0caRkIG2UhHYFrldc1E9sY+AWzAzK5cubA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4N3d836kx5z1DcN; Fri, 4 Nov 2022 11:05:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 2A4B5NGU028761; Fri, 4 Nov 2022 11:05:23 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 2A4B5NuZ028760; Fri, 4 Nov 2022 11:05:23 GMT (envelope-from git) Date: Fri, 4 Nov 2022 11:05:23 GMT Message-Id: <202211041105.2A4B5NuZ028760@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Mateusz Piotrowski <0mp@FreeBSD.org> Subject: git: 47c2569d8979 - main - security/trousers: Fix tcsd.conf permissions List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-all@freebsd.org X-BeenThere: dev-commits-ports-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: 0mp X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 47c2569d8979db687528456bd11c549a37ee4155 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1667559924; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ro4VCFXS5H2CEp++Nq47l0juiEKS/AWKrpoznjFnxLs=; b=lEP6THptuXor+S1XNvjMdloruBudzCiM1AkAJ10p9Lx/HvhJbO8v5lXwQnt/KuiZmIaAKs Qpb0N2tt8Dd30Oa1YvyhoR30QbZoqHIo2RSzyzl0CxqXq0bYxf1gBR8nkdDW59neYQIDSn 1OQcx136P5LJZTpoGPnjYHblfC36sFRWPTmW9/ARJrFCGGjBHR+6lMc27xI8Adw9Zggdpw 2tVveAAqFD/tW8HnDHWx7wW+ymcPRuG8M4oz942DjFQ0x1FdoaEIh9e/N1436OZODvbS35 4M3uZjj8EC3jgCy+94MtsGWrxeuaGB+rEJ2UC45EMn0svsE15cDIuoI/W1Mu6w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1667559924; a=rsa-sha256; cv=none; b=KQ/y/eG6j2zvYPtcIltmFIbCQarKeyajUbdYlKMVy+/BAaQQ5b3ki1R0Y1Z6APjMhVl1d8 735Pp0hnUp/YzyPb3RdLNuV+fljpLiy7EBHVLkyH7uQ/pRIe0Ixui9wrQy+bhvEWkNy0Iz Q7V354q/fLLul3GZx59Gl8DHgl8t5x8aFs0TB4W9qxw4XrGLMdJL1m36ID2mPRjKshc7ut FaYkk8KVLfW9HLBwXse1OeUtEyyqMxYg6ZeMggSce2W/4to39qyBaA7rey1N5904nzUIRH 7ovCUnTSPWU2xCE/a9P/HmGiUotdxLhfaThVCX+DFLfimE6gX26SiBje9VwvWQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by 0mp: URL: https://cgit.FreeBSD.org/ports/commit/?id=47c2569d8979db687528456bd11c549a37ee4155 commit 47c2569d8979db687528456bd11c549a37ee4155 Author: Mateusz Piotrowski <0mp@FreeBSD.org> AuthorDate: 2022-11-04 10:29:24 +0000 Commit: Mateusz Piotrowski <0mp@FreeBSD.org> CommitDate: 2022-11-04 11:05:09 +0000 security/trousers: Fix tcsd.conf permissions It turns out that tcsd requires the ownership of tcsd.conf file to be set to root:_tss. See trousers-0.3.14_3/src/tcsd/tcsd_conf.c for details. Otherwise, tcsd fails: # service tcsd start Starting tcsd. /usr/local/etc/rc.d/tcsd: WARNING: failed to start tcsd # tail /var/log/messages Nov 4 11:24:43 x TCSD[1298]: TrouSerS ERROR: TCSD config file (/usr/local/etc/tcsd.conf) must be user/group root/_tss Nov 4 11:24:43 x 0mp[2372]: /usr/local/etc/rc.d/tcsd: WARNING: failed to start tcsd Also, the mode of the configuration file has to be 640. PR: 253858 Reported by: unitrunker Approved by: maintainer timeout, portmgr blanket (runtime error) Sponsored by: Klara, Inc. --- security/trousers/Makefile | 2 +- security/trousers/files/tcsd.in | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/security/trousers/Makefile b/security/trousers/Makefile index 6c2cb841de65..ef15376beb24 100644 --- a/security/trousers/Makefile +++ b/security/trousers/Makefile @@ -1,6 +1,6 @@ PORTNAME= trousers PORTVERSION= 0.3.14 -PORTREVISION= 3 +PORTREVISION= 4 CATEGORIES= security MASTER_SITES= SF diff --git a/security/trousers/files/tcsd.in b/security/trousers/files/tcsd.in index eb36dfcbcd83..78b01750b5f3 100644 --- a/security/trousers/files/tcsd.in +++ b/security/trousers/files/tcsd.in @@ -26,9 +26,12 @@ tcsd_precmd() { /usr/bin/install -d -m 0700 -o %%USERS%% -g %%GROUPS%% \ /var/run/tpm /var/run/ima %%PREFIX%%/var/lib/tpm - /usr/sbin/chown %%USERS%%:%%GROUPS%% \ + # The configuration files must be owned by root so + # that the %%USERS%% user can only read (but not manipulate) + # the configuration file. + /usr/sbin/chown root:%%GROUPS%% \ %%PREFIX%%/etc/tcsd.conf - /bin/chmod 0600 \ + /bin/chmod 0640 \ %%PREFIX%%/etc/tcsd.conf }