Merge lp:~jtv/maas/pkg-bug-1060095 into lp:~maas-maintainers/maas/packaging

[Jeroen T. Vermeulen]

Make maas_local_settings readable only to root & maas.

As discussed with Raphael. This file should be private. Only the installation process has legitimate reason to write to it, and root aside, only maas has a legitimate reason to read from it.

Jeroen

[lp:~jtv/maas/pkg-bug-1060095]

113. By Jeroen T. Vermeulen on 2012-10-02

Review fix.

[Gavin Panella (allenap)]

review: Approve

[John A Meinel (jameinel)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/2/2012 2:26 PM, Jeroen T. Vermeulen wrote:
> Jeroen T. Vermeulen has proposed merging
> lp:~jtv/maas/pkg-bug-1060095 into lp:maas.
>
> Commit message: Make maas_local_settings readable only to root &
> maas.
>
> Requested reviews: Launchpad code reviewers (launchpad-reviewers)
> Related bugs: Bug #1060095 in MAAS: "Database password in
> maas_local_settings.py is world-readable"
> https://bugs.launchpad.net/maas/+bug/1060095
>
> For more details, see:
> https://code.launchpad.net/~jtv/maas/pkg-bug-1060095/+merge/127450
>
> As discussed with Raphael. This file should be private. Only the
> installation process has legitimate reason to write to it, and root
> aside, only maas has a legitimate reason to read from it.
>
>
> Jeroen
>

You are still targetting 'lp:maas' but with a branch that has the
debian/ directory. I think you mean ubuntu:maas or something along
those lines.

 review: needsfixing

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (Cygwin)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iEYEARECAAYFAlBrDLwACgkQJdeBCYSNAAM2zQCeM9LHhteNn0QuvAUJhcL/Oulz
f6EAn3exBhbbu7eRUUPwLFl/Jf9rX+E2
=MM0V
-----END PGP SIGNATURE-----

review: Needs Fixing

[Jeroen T. Vermeulen (jtv)]

It's a packaging branch. I *always* forget to set the target branch on my packaging MPs.

Note how this MP says it's "superseded" by an MP with a corrected target. That means that there's no point in looking at it at all.

=== modified file 'debian/maas-region-controller.postinst'
--- debian/maas-region-controller.postinst	2012-10-01 10:35:56 +0000
+++ debian/maas-region-controller.postinst	2012-10-02 11:03:19 +0000
@@ -137,10 +137,14 @@
 	mkdir -p /var/lib/maas/media/storage
 	chown -R maas:maas /var/lib/maas/
 
-	# Local celery config may contain credentials, so should be readable
+	# Config will contain credentials, so should be readable
 	# by the application but nobody else.
-	chown root:maas /etc/maas/maas_local_celeryconfig.py
-	chmod 0640 /etc/maas/maas_local_celeryconfig.py
+	chown root:maas \
+		/etc/maas/maas_local_celeryconfig.py \
+		/etc/maas/maas_local_settings.py
+	chmod 0640 \
+		/etc/maas/maas_local_celeryconfig.py \
+		/etc/maas/maas_local_settings.py
 
 	#########################################################
 	################  Configure Apache2  ####################