Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
25.10.4
-
None
-
MXS-SPRINT-280
-
Related to install and upgrade
-
Upgrades no longer overwrite the directory permissions if they've been modified by the user as long as the directory is still owned by the maxscale user.
Description
Maxscale 25.10.4-1, RPM and DEB packages' `postinst` scripts set the following directories to `0755` permission on every install and upgrade:
/var/log/maxscale
|
/var/lib/maxscale
|
/etc/maxscale.modules.d
|
/etc/maxscale.cnf.d
|
|
A customer's internal security policy requires `0750` on these paths. Since the `postinst` script unconditionally resets permissions to `0755` on every install/upgrade, they are forced to manually reapply `0750` each time, and their security monitoring tools raise alarms in between.
Setting the permission of directories to world-readable seems to cause security issues.
Lines 10-15:
# Change the owner of the directories to maxscale:maxscale
|
for path in "/var/log/maxscale" "/var/lib/maxscale" "/etc/maxscale.modules.d" "/etc/maxscale.cnf.d" |
do
|
chown -R maxscale:maxscale "$path" |
chmod 0755 "$path" |
done
|
|
Requesting feasibility review of setting `0750` as the default in the install scripts, so customers do not need to apply this manually after every install/upgrade.