[pacman-dev] [PATCH] pacman-key: check required permissions on keyring

[Allan McRae]

Makes sure that the pacman keyring is readable and that the user
has permissions to create a lock file if lock-never is not specified
in the gpg.conf file.

Signed-off-by: Allan McRae <al...@archlinux.org>
---
 scripts/pacman-key.sh.in |   20 ++++++++++++++++++++
 1 files changed, 20 insertions(+), 0 deletions(-)

diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in
index 4ea9842..b4e7abc 100644
--- a/scripts/pacman-key.sh.in
+++ b/scripts/pacman-key.sh.in
@@ -112,6 +112,25 @@ initialize() {
        fi
 }
 
+check_keyring() {
+       if [[ ! -r ${PACMAN_KEYRING_DIR}/pubring.gpg || \
+                       ! -r ${PACMAN_KEYRING_DIR}/secring.gpg || \
+                       ! -r ${PACMAN_KEYRING_DIR}/trustdb.gpg ]]; then
+               error "$(gettext "You do not have sufficient permissions to 
read the %s keyring...")" "pacman"
+               msg "$(gettext "Use '%s' to correct the keyring permissions.")" 
"pacman-key --init"
+               exit 1
+       fi
+
+       if (( (EXPORT || FINGER || LIST || VERIFY) && EUID != 0 )); then
+               if ! grep -w -q "lock-never" ${PACMAN_KEYRING_DIR}/gpg.conf 
&>/dev/null; then
+                       error "$(gettext "You do not have sufficient 
permissions to run this command...")"
+                       msg "$(gettext "Use '%s' to correct the keyring 
permissions.")" "pacman-key --init"
+                       exit 1
+               fi
+       fi
+
+}
+
 verify_keyring_input() {
        local ret=0;
 
@@ -344,6 +363,7 @@ if (( numopt != 1 )); then
        exit 1
 fi
 
+(( ! INIT )) && check_keyring
 
 (( ADD )) && ${GPG_PACMAN} --quiet --batch --import "${KEYFILES[@]}"
 (( DELETE )) && ${GPG_PACMAN} --quiet --batch --delete-key --yes "${KEYIDS[@]}"
-- 
1.7.6