Custom Query (115 matches)

The current svn (r243) fails to build a Debian package, using both dpkg-buildpackage as well as debian/rules binary.

The problem with the last few commits is that the install target in scripts/Makefile.in does not honour $(DESTDIR), resulting in the script files being installed in the root filesystem.

Also, the directory to install in is not created, so install might fail when the script directory does not exist at installation time.

The attached patch fixes both of these issues. However, I'm not completely sure this is the right approach. The same Makefile.in also defines a install-vuurmuur_scriptDATA target, which seems to do exacty what the install target should do. Why is this not used, and what is it used for?

The attached patch cleans up vuurmuur_fopen a bit. It removes all checks from the function and instead calls stat_ok do do these checks. This has the following functional changes:

• vuurmuur_fopen now only works for regular files (non fifo's, character devices, etc.). This shouldn't be a problem, config files should be regular files anyway.
• vuurmuur_fopen now only works for existing files. This is because stat_ok fails when a stat call fails, without special case for a "File not found" error. The original vuurmuur_fopen function skipped all checks when lstat returned an error (which might have been wrong, since an error does not always mean "File not found").
  However, I have checked all uses of the vuurmuur_fopen function, and all of them use it only on existing files (add_textdir uses plain fopen to create new files.

The patch is against svn r240.

Currently, vuurmuur insists on its config files not having the group-read and other-read permission bits set (among a few other checks, such as not being writable by others and being owned by root). These checks make sense in general, but for my particular installation I need the files to be readable by world. Currently, vuurmuur resets the permissions of the files when it finds anything out of order.

After a small discussion on IRC it seems feasible to implement an option to prevent the permission changes for files that are readable for group or other. I would propose adding an option "ALLOW_READABLE_CONFIG" to config.conf, which would default to "No".

I'm currently looking at the code and plan to submit a patch, probably preceded by some cleanup work in separate patches.