Re: debian package cfengine2 is broken? permissions on /var/lib/cfengine2

[Phil D'Amore]

The real directory it is complaining about here is probably 
/var/lib/cfengine2/ppkeys.  This bit me with my RPM after going to 
2.0.8p1.  I'm assuming w/o RTFS that there was a check placed in the 
code to verify the perms on the key directory (ppkeys) are tight.  When 
cfkey runs and no ppkeys directory exists it is auto-created mode 0400, 
so there is no issue.  For me, I found that I was not preserving this in 
my RPM's %files section, and upgrades where causing the permissions to 
revert to something less secure, causing cfengine to complain.

Explicitly fixing my package to set the perms on the ppkeys dir to 0400 
solves it.

Kief Morris wrote:

> I'm no longer able to install the cfengine2 package from the testing 
> distribution of Debian.
> Upgrading it on machines where it's already installed doesn't seem to cause a 
> problem,
> but a new install gets an error when I do apt-get install cfengine2:
>
>    Selecting previously deselected package cfengine2.
>   (Reading database ... 14446 files and directories currently installed.)
>    Unpacking cfengine2 (from .../cfengine2_2.0.9+2.1.0b3-1_i386.deb) ...
>    Setting up cfengine2 (2.0.9+2.1.0b3-1) ...
>    ::UNTRUSTED: Private key directory /var/lib/cfengine2 was not private!
>
> The /var/lib/cfengine2 directory doesn't exist before I run the install, so 
> it's the
> install process which is setting up the directory and then bitching that it 
> doesn't
> like the permissions on it.
>
> I'm asking here because I've seen a couple messages on this list about
> permissions on this directory under Debian, so I'm wondering if there's a link,
> or at least people who understand what's going wrong.
>
> Thanks,
> Kief
>
>
>
> _______________________________________________
> Help-cfengine mailing list
> Help-cfengine@gnu.org
> http://mail.gnu.org/mailman/listinfo/help-cfengine
>  

--
Phil D'Amore                             "Sometimes there is a fine line
Senior System Administrator               between criminally abusive
Red Hat, Inc                              behavior and fun."
Office: 919.754.3700 x44395                 -- Ted the Generic Guy
Pager: 877.383.8795                            (Dilbert 4/19/2003)