[Logcheck-commits] martin f. krafft: Set permissions on /var/lib/ logcheck to 0770 to prevent disclosure of information (closes: #481347).

[Martin F. Krafft]

Module: logcheck
Branch: master
Commit: 386f674e282a4ea7ac3657e4d1c03518b18ed410
URL:    http://git.debian.org/?p=logcheck/logcheck.git/?a=commit;h=386f674e282a4ea7ac3657e4d1c03518b18ed410

Author: martin f. krafft <madduck at madduck.net>
Date:   Thu May 15 13:51:26 2008 +0100

Set permissions on /var/lib/logcheck to 0770 to prevent disclosure of information (closes: #481347).

---

 debian/changelog         |    3 +++
 debian/logcheck.postinst |    5 +++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index 569a5ec..9eeab3b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -110,6 +110,9 @@ logcheck (1.2.64) unstable; urgency=low
     - ignore warnings about bad signature data; thanks to Clint Adams
       (closes: #478334).
 
+  * Set permissions on /var/lib/logcheck to 0770 to prevent disclosure of
+    information (closes: #481347).
+
  -- martin f. krafft <madduck at debian.org>  Wed, 30 Apr 2008 12:01:31 +0400
 
 logcheck (1.2.63) unstable; urgency=low
diff --git a/debian/logcheck.postinst b/debian/logcheck.postinst
index b13eb7c..4bfa408 100644
--- a/debian/logcheck.postinst
+++ b/debian/logcheck.postinst
@@ -75,9 +75,8 @@ case "$1" in
 	# unreadable upon upgrade.  <ttroxell at debian.org>
 	chgrp -R logcheck /etc/logcheck || true
 
-    	# Set Permissions on install or upgrade
+    	# Set Permissions on install, not upgrade
 	if [ ! -n "$2" ]; then
-    	  chown -R logcheck:logcheck /var/lib/logcheck  || true
           chmod 2750 /etc/logcheck/ignore.d.paranoid || true
           chmod 2750 /etc/logcheck/ignore.d.workstation || true
           chmod 2750 /etc/logcheck/ignore.d.server || true
@@ -89,6 +88,8 @@ case "$1" in
           # just in case
           chown logcheck /var/lock/logcheck > /dev/null || true
 	fi
+    	chown -R logcheck:logcheck /var/lib/logcheck || true
+    	chmod 0770 /var/lib/logcheck || true
 
 	;;