[Zope] Re: installation security best practice question

[Tres Seaver]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Luca Olivetti wrote:
> En/na Tres Seaver ha escrit:
> 
>>
>> Note that I think the original poster must not have done 'make install',
>> but rather was using an inplace build directly from the unpacked
>> tarball:  the install process would have fixed up the permissions
>> otherwise.
> 
> 
> No, it doesn't (with 2.8.6)
> 
> Bye

OK, after some investigation:  the issue is not the weird UID/GID on the
files (which get preserved when unpacking the tarball as root);  the
issue is that the person making the file had their umask set to harshly
(0077, likely), which means that the files are not readable by anyone
but the owner.  A workaround is to change the readability after
unpacking the tarball, e.g.:

 $ chmod -R a+r .

Andreas, can you confirm?


Tres.
- --
===================================================================
Tres Seaver          +1 202-558-7113          tseaver at palladion.com
Palladion Software   "Excellence by Design"    http://palladion.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFEGDoC+gerLs4ltQ4RAt1tAJ9OkVihsS2Nvgt4hDv+FKtLP5oReQCferMr
Nnoc8K10mVYf9xI3h0BHezk=
=x69l
-----END PGP SIGNATURE-----