Uploaded image for project: 'MariaDB MaxScale'
  1. MariaDB MaxScale
  2. MXS-7597

Packaging scripts set 0755 on MaxScale config, data and log directories on every install/upgrade making it world readable

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 25.10.4
    • 25.10.5
    • Packaging
    • None
    • MXS-SPRINT-280
    • Related to install and upgrade
    • Upgrades no longer overwrite the directory permissions if they've been modified by the user as long as the directory is still owned by the maxscale user.

    Description

      Maxscale 25.10.4-1, RPM and DEB packages' `postinst` scripts set the following directories to `0755` permission on every install and upgrade:

      /var/log/maxscale
      /var/lib/maxscale
      /etc/maxscale.modules.d
      /etc/maxscale.cnf.d
      
      

      A customer's internal security policy requires `0750` on these paths. Since the `postinst` script unconditionally resets permissions to `0755` on every install/upgrade, they are forced to manually reapply `0750` each time, and their security monitoring tools raise alarms in between.

      Setting the permission of directories to world-readable seems to cause security issues.

      Lines 10-15:

      # Change the owner of the directories to maxscale:maxscale
      for path in "/var/log/maxscale" "/var/lib/maxscale" "/etc/maxscale.modules.d" "/etc/maxscale.cnf.d"
      do
         chown -R maxscale:maxscale "$path"
         chmod 0755 "$path"
      done
      
      

      Requesting feasibility review of setting `0750` as the default in the install scripts, so customers do not need to apply this manually after every install/upgrade.

      Attachments

        Activity

          People

            markus makela markus makela
            krishnaprasad Krishna Prasad
            Votes:
            1 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

                Estimated:
                Original Estimate - 1d
                1d
                Remaining:
                0d
                Logged:
                Time Not Required
                Not Specified

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.