The Eclectic One <[email protected]> writes: > Well, the system is now fixed, so I can't go back and see how it used to > be, but maybe /var/log/news/news is created with the wrong ownership > (root most likely) or permissions, even though it might be an empty file > at first? Or maybe /var/log/news had already been created somewhere > else with root ownership or 644 permissions?
It looks like /var/log/news may be created with the wrong permissions in the installer, although the situation isn't as yet clear. > From the start I suspected that this was a permission problem in the > Debian install scripts. While researching a fix I found the inncheck > tests and thought that a script that is part of inn would certainly know > the correct ownership/permissions. Why should the debian install be so > different (with regards to file ownership/permissions) from the install > from source? It's a combination of a couple of things. First, inncheck is partly incorrect. It's not gotten much love and attention for quite some time. Not everything that it complains about is really a problem. It's somewhat better in what will be 2.5. You won't *hurt* anything by following inncheck's recommendations, but many of those changes aren't really necessary. Second, inncheck currently assumes a traditional INN installation where all the files are owned by the news user. This is useful if you want to update the installation as the news user rather than as root, but it's contrary to Debian Policy (and most other distributions), which want all installed files to be owned by root unless there's some compelling reason to do otherwise. The traditional INN installation ownership is arguably somewhat less secure, since should someone find an exploit in INN, it allows them to then trojan the binaries, whereas with Debian's permission scheme they cannot. Similarly, inncheck assumes that you're going to log in as the news user to do things like edit the configuration files, whereas Debian assumes that configuration files will be modified by a root-owned process. Making the news user an actual user is the old way of doing this, but Debian's setup is better if you're using a real configuration management system (and regardless makes INN more like the rest of the system). INN has, as a goal, convenience for people running INN, and it's supporting the way that INN used to be installed and configured going back to the original releases. Debian makes INN behave like the rest of the system. They're both legitimate approaches, but in a Debian package, the Debian approach is the correct one. -- Russ Allbery ([email protected]) <http://www.eyrie.org/~eagle/> -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
