Merge pull request #3476 from citrus-it/perms

Normalise file permissions when generating manifests

build/dma/local.mog

@@ -8,14 +8,15 @@
 # source. A copy of the CDDL is also available via the Internet at
 # http://www.illumos.org/license/CDDL.
 #
-# Copyright 2017 OmniOS Community Edition (OmniOSce) Association.
+# Copyright 2024 OmniOS Community Edition (OmniOSce) Association.
 
 user username=dma uid=26 group=mail gcos-field="DragonFly Mail Agent" \
     home-dir=/ password=NP
 
 <transform dir path=var/mail$ -> drop>
 <transform file path=etc/dma/ -> set preserve renamenew>
 <transform file dir path=etc/dma -> set group mail>
+<transform file path=etc/dma/auth.conf -> set mode 0640>
 <transform file path=usr/lib/smtp/dma -> set group mail>
 <transform file path=usr/lib/smtp/dma/dma -> set mode 2755>
 <transform file path=usr/lib/smtp/dma/dma-mbox-create -> set mode 4754>

build/sudo/local.mog

@@ -9,14 +9,16 @@
 # http://www.illumos.org/license/CDDL.
 #
 # Copyright 2011-2012 OmniTI Computer Consulting, Inc.  All rights reserved.
-# Copyright 2023 OmniOS Community Edition (OmniOSce) Association.
+# Copyright 2024 OmniOS Community Edition (OmniOSce) Association.
 #
 
 <transform path=var/db -> drop>
 
 <transform file dir path=etc/sudoers -> set group root>
 <transform file path=etc/sudoers$ -> set preserve renamenew>
 <transform file path=etc/sudo.conf -> set preserve renamenew>
+<transform file path=etc/sudoers -> set mode 0440>
+<transform dir path=etc/sudoers.d -> set mode 0750>
 
 <transform file path=usr/bin/sudo$ -> set mode 4511>
 <transform file path=usr/bin/sudoreplay$ -> set mode 0511>

lib/functions.sh

@@ -1733,8 +1733,26 @@ generate_manifest() {
             GENERATE_ARGS+="--target $f "
         done
     fi
-    logcmd -p $PKGSEND generate $GENERATE_ARGS $DESTDIR > $outf \
-        || logerr "------ Failed to generate manifest"
+    # `pkgsend generate` will produce a manifest based on the files it
+    # finds under $DESTDIR. It will set the ownership and group in generated
+    # lines to root:bin, but will copy the mode attribute from the file it
+    # finds. The modes of files in this directory do generally accurately
+    # reflect executability, but other bits may be set depending on how the
+    # temporary directory is set up. For example, in a shared build workspace
+    # there could be extended ACLs to maintain writeability by the owning
+    # group, or the sticky group attribute may be set on directories.
+    # Rather than implicitly trusting the mode that is found, we normalise it
+    # to something more generic.
+    logcmd -p $PKGSEND generate $GENERATE_ARGS $DESTDIR | sed  -E '
+        # Strip off any special attributes such as setuid or sticky group
+        s/\<mode=0[[:digit:]]+([[:digit:]]{3})\>/mode=0\1/
+        # Reduce group/other permissions
+        s/\<mode=0([75])[[:digit:]]{2}\>/mode=0\155/
+        s/\<mode=0([64])[[:digit:]]{2}\>/mode=0\144/
+        # Convert unexpected modes to something reasonable
+        s/\<mode=02[[:digit:]]{2}\>/mode=0644/
+        s/\<mode=0[13][[:digit:]]{2}\>/mode=0755/
+    ' > $outf || logerr "------ Failed to generate manifest"
 }
 
 convert_version() {