Added a slightly modified version of the anti-fascist patch (allows for

a configurable admingroup to be set, instead of forcing it to be root),
closes debian bug#370396

diff --git a/AUTHORS b/AUTHORS
index 4181b7358fe9561a57b54735c6199072fd0c2db7..8b615d15c1e588cfb7f24ba3d19d1b55da9b9816 100644 (file)
--- a/AUTHORS
+++ b/AUTHORS
@@ -15,3 +15,4 @@ cmccallum@thecsl.org
 Daniel.Bonniot@inria.fr
 Brad Fritz <brad@fritzfam.com> -- trac patch
 garcondumonde@riseup.net
+Martin Krafft madduck@debian.org -- admingroup patch
\ No newline at end of file

diff --git a/ChangeLog b/ChangeLog
index 07430cedf5a6aeb639386a1c228ba44b00148875..b1e9fd700ddfcf2dc6d9284d8398a60b0972131a 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,11 @@ version 0.9.4 -- unreleased
         . Fixed bug in toint(), and thus isnow(), which caused it
           to not work when run from cron.
         . Recursively ignore subdirs in /etc/backup.d (Closes: #361102)
+        . Add admingroup option to configuration to allow a group that can
+          read/write configurations (instead of only allowing root). Checks
+          and complains about group-readable files only when the group differs
+          from the one in the configuration file (default is root as before). 
+          Thanks to Martin Krafft for the patch (Closes: #370396).
     handler changes
        Added tar handler
        mysql:

diff --git a/etc/backupninja.conf.in b/etc/backupninja.conf.in
index 362eb5992804cb46e334e61d97946828d594a602..10ac2bb9787fe22058d3aae82f217758d8d5c8bf 100644 (file)
--- a/etc/backupninja.conf.in
+++ b/etc/backupninja.conf.in
@@ -25,6 +25,10 @@ reportsuccess = yes
 # even if there was no error. (default = yes)
 reportwarning = yes
 
+# set to the administration group that is allowed to 
+# read/write configuration files in /etc/backup.d
+admingroup = root
+
 #######################################################
 # for most installations, the defaults below are good #
 #######################################################

diff --git a/src/backupninja.in b/src/backupninja.in
index 2835a3c55950381b051c338050d1d968112eb77b..57936da1d4b2ce5a521dcbdae05c3ee7ed218aa7 100755 (executable)
--- a/src/backupninja.in
+++ b/src/backupninja.in
@@ -130,17 +130,37 @@ function msg {
 #
 
 function check_perms() {
-       local file=$1
-       local perms=`ls -ld $file`
-       perms=${perms:4:6}
-       if [ "$perms" != "------" ]; then
-               echo "Configuration files must not be group or world writable/readable! Dying on file $file"
-               fatal "Configuration files must not be group or world writable/readable! Dying on file $file"
-       fi
-       if [ `ls -ld $file | awk '{print $3}'` != "root" ]; then
-               echo "Configuration files must be owned by root! Dying on file $file"
-               fatal "Configuration files must be owned by root! Dying on file $file"
-       fi
+   local file=$1
+   local perms
+   perms=($(stat -L --printf='%a %g %G %u %U' $file))
+   local gperm=${perms[0]:1:1}
+   local wperm=${perms[0]:2:1}
+   local gid=${perms[1]}
+   local group=${perms[2]}
+   local owner=${perms[3]}
+
+   if [ "$owner" != 0 ]; then
+      echo "Configuration files must be owned by root! Dying on file $file"
+      fatal "Configuration files must be owned by root! Dying on file $file"
+   fi
+   
+   if [ $wperm -gt 0 ]; then
+      echo "Configuration files must not be world writable/readable! Dying on file $file"
+      fatal "Configuration files must not be world writable/readable! Dying on file $file"
+   fi
+
+   if [ $gperm -gt 0 ]; then
+      case "$admingroup" in
+         $gid|$group) :;;
+
+         *)
+           if [ "$gid" != 0 ]; then
+              echo "Configuration files must writable/readable by group ${perms[2]}! Dying on file $file"
+              fatal "Configuration files must writable/readable by group ${perms[2]}! Dying on file $file"
+           fi
+         ;;
+         esac
+   fi
 }
 
 # simple lowercase function
@@ -423,6 +443,7 @@ getconf PGSQLDUMP /usr/bin/pg_dump
 getconf PGSQLDUMPALL /usr/bin/pg_dumpall
 getconf GZIP /bin/gzip
 getconf RSYNC /usr/bin/rsync
+getconf admingroup root
 
 # initialize vservers support
 # (get config variables and check real vservers availability)
@@ -461,6 +482,7 @@ fi
 for file in $files; do
        [ -f "$file" ] || continue
 
+        check_perms ${file%/*} # check containing dir
        check_perms $file
        suffix="${file##*.}"
        base=`basename $file`