starlingx
/
fault
Code Issues Proposed changes

Restrict fmClientCli binary permissions 

The fmClientCli binary can create and delete alarms freely on the
system, so the access to this binary should be restricted to Linux admin
users.

Test Plan:

PASS: Deploy an AIO-SX using a Debian image containing this change and
check that the permissions for file "/usr/local/bin/fmClientCli" is
"-rwxr-x---" and the owner:group is root:root.
PASS: Repeat the test above using a CentOS image.

Closes-Bug: 1991118
Signed-off-by: Joao Victor Portal <Joao.VictorPortal@windriver.com>
Change-Id: I0375ddc68ae1b5967447a326780272f77695793a
This commit is contained in:
Joao Victor Portal 2022-09-26 11:00:57 -03:00
parent 80d6819635
commit 74d56e72a0
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fm-common/debian/deb_folder/rules
View File

@ -17,5 +17,8 @@ override_dh_auto_install:
CGCS_DOC_DEPLOY=/opt/deploy/cgcs_doc install
python3 setup.py install --install-layout=deb --root $(ROOT)
override_dh_fixperms:
dh_fixperms -XfmClientCli
override_dh_usrlocal:
# do nothing

2
fm-common/sources/Makefile
View File

@ -54,7 +54,7 @@ install:
install -m 755 -d $(DESTDIR)$(LIBDIR)
install -m 755 -d $(DESTDIR)$(INCDIR)
install -m 755 -d $(DESTDIR)$(CGCS_DOC_DEPLOY)
install -m 755 fmClientCli $(DESTDIR)$(BINDIR)
install -m 750 fmClientCli $(DESTDIR)$(BINDIR)
install -m 755 fm_db_sync_event_suppression.py $(DESTDIR)$(BINDIR)
install -m 755 fm_log.py $(DESTDIR)$(BINDIR)
install -m 644 fmDbAPI.h $(DESTDIR)$(INCDIR)