net-firewall/nftables: Touch rules-save with right umask

The nftables ebuild contains code to ensure the rules-save
file is created so the service will start on systemd based
systems.

The current code creates the file with default permissions
644 which triggers the code for detecting misconfigured system
added to address bug #691326

Instead of just using touch, start a subshell so we can call
umask beforehand and address the issue.

Bug: https://bugs.gentoo.org/691326
Signed-off-by: Francisco Blas Izquierdo Riera (klondike) <klondike@gentoo.org>
Package-Manager: Portage-2.3.76, Repoman-2.3.11
Signed-off-by: Matthew Thode <prometheanfire@gentoo.org>

diff --git a/net-firewall/nftables/nftables-0.9.0-r5.ebuild b/net-firewall/nftables/nftables-0.9.0-r5.ebuild
index 24530d29291c2b1e58253ca9c8f80a77ab175988..2ad8c89d4c73c340195e551da413466a76e41e79 100644 (file)
--- a/net-firewall/nftables/nftables-0.9.0-r5.ebuild
+++ b/net-firewall/nftables/nftables-0.9.0-r5.ebuild
@@ -84,7 +84,7 @@ pkg_postinst() {
        # In order for the nftables-restore systemd service to start
        # the save_file must exist.
        if [[ ! -f "${save_file}" ]]; then
-               touch "${save_file}"
+               ( umask 177; touch "${save_file}" )
        elif [[ $(( "$( stat --printf '%05a' "${save_file}" )" & 07177 )) -ne 0 ]]; then
                ewarn "Your system has dangerous permissions for ${save_file}"
                ewarn "It is probably affected by bug #691326."

diff --git a/net-firewall/nftables/nftables-0.9.1-r1.ebuild b/net-firewall/nftables/nftables-0.9.1-r1.ebuild
index 5752d73a1b962d32792bd0ef11a3c9c84f201981..ef662d78f71675352ed236a97a74f337a5145608 100644 (file)
--- a/net-firewall/nftables/nftables-0.9.1-r1.ebuild
+++ b/net-firewall/nftables/nftables-0.9.1-r1.ebuild
@@ -130,7 +130,7 @@ pkg_postinst() {
        # In order for the nftables-restore systemd service to start
        # the save_file must exist.
        if [[ ! -f "${save_file}" ]]; then
-               touch "${save_file}"
+               ( umask 177; touch "${save_file}" )
        elif [[ $(( "$( stat --printf '%05a' "${save_file}" )" & 07177 )) -ne 0 ]]; then
                ewarn "Your system has dangerous permissions for ${save_file}"
                ewarn "It is probably affected by bug #691326."

diff --git a/net-firewall/nftables/nftables-0.9.2-r1.ebuild b/net-firewall/nftables/nftables-0.9.2-r1.ebuild
index d35797947814030a5684d2ef2e3c1f1a060ba587..f8649c46afaf41f843acf035d28a70c71e69268f 100644 (file)
--- a/net-firewall/nftables/nftables-0.9.2-r1.ebuild
+++ b/net-firewall/nftables/nftables-0.9.2-r1.ebuild
@@ -125,7 +125,7 @@ pkg_postinst() {
        # In order for the nftables-restore systemd service to start
        # the save_file must exist.
        if [[ ! -f "${save_file}" ]]; then
-               touch "${save_file}"
+               ( umask 177; touch "${save_file}" )
        elif [[ $(( "$( stat --printf '%05a' "${save_file}" )" & 07177 )) -ne 0 ]]; then
                ewarn "Your system has dangerous permissions for ${save_file}"
                ewarn "It is probably affected by bug #691326."