On Wednesday 25 of February 2015 17:29:11 Bastien Nocera wrote:
> abrt-dbus already allows users to list problems, and will make sure
> of filtering out problems that the user is not allowed to interact with.
> To avoid users knowing that particular problems are being created for
> another user, make sure that /var/tmp/abrt is not listable.
> ---
> abrt.spec.in | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/abrt.spec.in b/abrt.spec.in
> index 53d3308..d52e66b 100644
> --- a/abrt.spec.in
> +++ b/abrt.spec.in
> @@ -728,7 +728,7 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor
> &>/dev/null || : %{_mandir}/man5/abrt_event.conf.5.gz
> %config(noreplace) %{_sysconfdir}/libreport/events.d/smart_event.conf
> %{_mandir}/man5/smart_event.conf.5.gz
> -%dir %attr(0755, abrt, abrt) %{_localstatedir}/%{var_base_dir}/%{name}
> +%dir %attr(0750, abrt, abrt) %{_localstatedir}/%{var_base_dir}/%{name}
> %dir %attr(0700, abrt, abrt) %{_localstatedir}/spool/%{name}-upload
> # abrtd runs as root
> %dir %attr(0755, root, root) %{_localstatedir}/run/%{name}
Pushed. Thanks!
https://github.com/abrt/abrt/commit/61f3b160f609c112728e6cf3c55076aeabb75319
https://github.com/abrt/abrt/commit/a2933a10cd5e5e796ace5403ea8b6144ea7e7660
