Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change the system.map file permission only readable by root #368

Merged
merged 2 commits into from
Dec 21, 2023

Conversation

xumia
Copy link
Collaborator

@xumia xumia commented Dec 15, 2023

Why I did it

It is to fix the issue that local System.map file (if exists) is readable only by root, see https://static.open-scap.org/ssg-guides/ssg-debian11-guide-standard.html#xccdf_org.ssgproject.content_rule_file_permissions_systemmap.

The current status:

admin@test4:~$ ls -l /usr/lib/debug/boot/System.map-6.1.0-11-2-amd64
-rw-r--r-- 1 root root 3905746 Aug  8 11:18 /usr/lib/debug/boot/System.map-6.1.0-11-2-amd64
admin@test4:~$ head /usr/lib/debug/boot/System.map-6.1.0-11-2-amd64
0000000000000000 D __per_cpu_start
0000000000000000 D fixed_percpu_data
00000000000001ea A kexec_control_code_size
0000000000001000 D cpu_debug_store
0000000000002000 D irq_stack_backing_store
0000000000006000 D cpu_tss_rw
000000000000b000 D gdt_page
000000000000c000 d exception_stacks
admin@test4:~$ ls /boot/System.map-6.1.0-11-2-amd64 -l
-rw-r--r-- 1 root root 83 Dec  6 12:14 /boot/System.map-6.1.0-11-2-amd64
admin@test4:~$ 

We already have a fix: #329, but it was not used for upgrading to bookworm code conflict.

How I did it

The issue only in debian package, it is not caused by the Linux Kernel.
Change the rules.real build script to set the permission to 600.

It fixes the Symtem.map permission issue in both /boot folder and in /usr/lib/debug/boot/.

@xumia xumia requested a review from a team as a code owner December 15, 2023 09:36
@xumia xumia requested a review from saiarcot895 December 15, 2023 09:38
@xumia
Copy link
Collaborator Author

xumia commented Dec 15, 2023

@saiarcot895 , could you please help review it? Thanks.

@saiarcot895 saiarcot895 merged commit 5d83a17 into sonic-net:master Dec 21, 2023
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants