Control: tags 1029137 + patch Attached is a patch modernizing debian/rules to the dh sequencer, as requested.
Every plain dh_* call that had no custom behavior (dh_installdocs, dh_installexamples, dh_link, dh_strip, dh_compress, dh_installdeb, dh_lintian, dh_shlibdeps, dh_gencontrol, dh_md5sums, dh_builddeb) is now implicit in the dh sequence. What's left as explicit overrides/hooks: - override_dh_auto_configure / _build / _install: the real source lives in src/, not the top level, so default dh_auto_* detection doesn't apply -- full overrides, not execute_before/after, since there's no default behavior to layer on top of. - execute_after_dh_auto_clean: additive, removes the extra generated files (pppoe.prj, config.h, etc.) the upstream build leaves behind, after letting the default dh_auto_clean run first. - override_dh_installchangelogs: the upstream changelog lives at doc/CHANGES, not a path dh_installchangelogs finds on its own. - execute_after_dh_fixperms: the setuid pppoe binary and the restricted dsl-provider file, both applied after the default dh_fixperms run. That last point surfaced a real, separate, pre-existing bug I want to be upfront about rather than bury in the diff: in the *original*, unmodified 4.0-1 rules, the dsl-provider install command ran *before* dh_fixperms in the sequence -- and dh_fixperms silently resets it back to default 644/root:root regardless, undoing the intended `install -m 0640 -o root -g dip`. I reproduced this identically against a fresh, unmodified 4.0-1 build before concluding it was real and not something I'd introduced. Since dsl-provider is a PPPoE connection config file that can hold real ISP credentials, world-readable was a genuine, if minor, exposure. Fixed by moving the install into execute_after_dh_fixperms, the one hook guaranteed to run last -- same fix approach the binary's own setuid bit already needed for the identical reason. Also added a lintian-overrides entry for the new non-standard-file-perm tag this introduces, alongside (not replacing -- I made that mistake once locally and caught it before generating this patch) the existing elevated-privileges override already covering the setuid binary. Verified: - Full dpkg-buildpackage build succeeds against a fresh pristine 4.0-1 source tree with this patch applied - dsl-provider ships 640 root:dip, pppoe ships 4754 root:dip, confirmed directly from the built .deb's real contents - lintian passes clean (0 warnings) with both overrides in place - Patch applies with zero errors against a fresh pristine extraction, confirmed on a second, independent apply+build+verify pass Changes: - debian/rules (modernized to dh sequencer) - debian/changelog - debian/pppoe.lintian-overrides (new tag added, existing one preserved)
--- a/debian/rules 2024-05-20 08:34:44.000000000 +0000 +++ b/debian/rules 2026-10-09 05:57:08.490073304 +0000 @@ -4,22 +4,33 @@ #export DH_VERBOSE=1 export DEB_BUILD_MAINT_OPTIONS = hardening=+all -DPKG_EXPORT_BUILDFLAGS = 1 -include /usr/share/dpkg/buildflags.mk -build: build-arch build-indep -build-arch: build-stamp -build-indep: build-stamp -build-stamp: - dh_testdir +%: + dh $@ + +# Real source lives in src/, not the top level, so the default +# dh_auto_configure/dh_auto_build/dh_auto_install detection (which looks +# for a top-level configure/Makefile) doesn't apply -- full overrides, +# not execute_before/after, since there's no default behavior to layer +# on top of here. +override_dh_auto_configure: test -f src/Makefile || (cd src && PPPD=/usr/sbin/pppd ./configure) + +override_dh_auto_build: $(MAKE) -C src - touch build-stamp -clean: - dh_testdir - dh_testroot - rm -f build-stamp +override_dh_auto_install: + $(MAKE) -C src install DESTDIR=$(CURDIR)/debian/pppoe +# Now clean out unwanted things, and move others to their places + rm -rf debian/pppoe/etc/ppp debian/pppoe/usr/share/doc + rm -rf debian/pppoe/usr/man/man5 # pppoe.conf manpage + rm -f debian/pppoe/usr/sbin/adsl-* debian/pppoe/usr/man/man8/adsl-* + rm -f debian/pppoe/usr/sbin/pppoe-setup + +# Additive, not replacing default dh_auto_clean -- let it run first +# (harmless even though the real Makefile lives in src/), then remove +# the extra generated files the upstream build leaves behind. +execute_after_dh_auto_clean: -rm -f pppoe.prj pppoe.log .pppoe.prcs_aux [ ! -f src/Makefile ] || $(MAKE) -C src distclean [ ! -f gui/Makefile ] || $(MAKE) -C gui distclean @@ -27,44 +38,26 @@ -rm -f debian/substvars.debhelper -rm -f config.h config.log config.status -rm -f Makefile libevent/Makefile - dh_clean -# Build architecture-independent files here. -binary-indep: build -# We have nothing to do by default. - -# Build architecture-dependent files here. -binary-arch: build - dh_testdir - dh_testroot - dh_prep - dh_installdirs usr/sbin usr/share - $(MAKE) -C src install DESTDIR="`pwd`/debian/pppoe" -# Now clean out unwanted things, and move others to their places - rm -rf debian/pppoe/etc/ppp debian/pppoe/usr/share/doc - rm -rf debian/pppoe/usr/man/man5 # pppoe.conf manpage - rm -f debian/pppoe/usr/sbin/adsl-* debian/pppoe/usr/man/man8/adsl-* - rm -f debian/pppoe/usr/sbin/pppoe-setup +# Non-default changelog location (doc/CHANGES, not a path +# dh_installchangelogs searches on its own). +override_dh_installchangelogs: + dh_installchangelogs doc/CHANGES + +# Additive: let the normal dh_fixperms run first, then apply the real +# non-default permissions these two paths need. dsl-provider is placed +# HERE, not in override_dh_auto_install, because dh_fixperms silently +# resets it back to default 644/root:root if installed any earlier -- +# a real, verified bug present in the current shipping package too +# (reproduced identically against an unmodified build), not something +# introduced by this restructuring. dsl-provider is a PPPoE connection +# config file (can hold real ISP credentials), so world-readable 644 is +# a genuine, if minor, exposure -- fixed here by ordering the install +# after the one hook that's guaranteed to run last. +execute_after_dh_fixperms: dh_installdirs etc/ppp/peers install -m 0640 -o root -g dip debian/dsl-provider \ debian/pppoe/etc/ppp/peers/dsl-provider - dh_installdocs - dh_installexamples -# dh_installmanpages - dh_installchangelogs doc/CHANGES - dh_link - dh_strip - dh_compress - dh_fixperms chgrp dip debian/pppoe/usr/sbin/pppoe chmod u+s debian/pppoe/usr/sbin/pppoe chmod o-x debian/pppoe/usr/sbin/pppoe - dh_installdeb - dh_lintian - dh_shlibdeps - dh_gencontrol - dh_md5sums - dh_builddeb - -binary: binary-indep binary-arch -.PHONY: build clean binary-indep binary-arch binary install --- a/debian/changelog 2024-05-21 12:48:43.000000000 +0000 +++ b/debian/changelog 2026-10-09 06:01:06.198150790 +0000 @@ -1,3 +1,32 @@ +rp-pppoe (4.0-2) UNRELEASED; urgency=medium + + * Modernize debian/rules to the dh sequencer (Closes: #1029137). + Replaces the hand-written build/clean/binary-arch targets with + `%: dh $@` plus override_dh_auto_configure/_build/_install for the + non-default src/ build layout, execute_after_dh_auto_clean for the + extra generated-file cleanup, override_dh_installchangelogs for the + non-default doc/CHANGES path, and execute_after_dh_fixperms for the + setuid pppoe binary and the restricted dsl-provider file. Every + plain dh_* call with no custom behavior (dh_installdocs, + dh_installexamples, dh_link, dh_strip, dh_compress, dh_installdeb, + dh_lintian, dh_shlibdeps, dh_gencontrol, dh_md5sums, dh_builddeb) is + now implicit in the dh sequence rather than spelled out by hand. + * Fix dsl-provider shipping world-readable (644 root:root) instead of + the intended 640 root:dip. Real, pre-existing bug reproduced + identically against an unmodified 4.0-1 build: dh_fixperms runs + automatically as part of the dh sequence and was silently resetting + the file's permissions back to default every time, regardless of + the explicit `install -m 0640 -o root -g dip` call upstream of it + in both the old and new rules. dsl-provider is a PPPoE connection + config file that can hold real ISP credentials, so world-readable + was a genuine, if minor, exposure. Fixed by moving the install into + execute_after_dh_fixperms, the one hook guaranteed to run last. + * Add debian/pppoe.lintian-overrides documentation for the new + non-standard-file-perm override this introduces, alongside the + pre-existing elevated-privileges override already covering the + setuid pppoe binary. + + -- Stefan Andrei Ionut <[email protected]> Fri, 9 Oct 2026 09:00:55 +0300 rp-pppoe (4.0-1) unstable; urgency=medium * The "Ella, elle l'a" release --- a/debian/pppoe.lintian-overrides 2024-05-20 08:34:44.000000000 +0000 +++ b/debian/pppoe.lintian-overrides 2026-10-09 06:00:19.550958160 +0000 @@ -1,3 +1,10 @@ # Shipping with setuid is intentional to allow unprivileged users belonging # to the dip group to dial in. pppoe: elevated-privileges 4754 root/dip [usr/sbin/pppoe] + +# dsl-provider is a PPPoE connection config file that can hold real ISP +# credentials (username/secret) -- deliberately restricted to root:dip +# 0640 rather than the default world-readable 0644. This is the actual +# intended permission (see debian/rules execute_after_dh_fixperms), not +# an oversight. +pppoe: non-standard-file-perm 0640 != 0644 [etc/ppp/peers/dsl-provider]
