https://bugzilla.novell.com/show_bug.cgi?id=849720 https://bugzilla.novell.com/show_bug.cgi?id=849720#c Fred P changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #566771|application/octet-stream |text/plain mime type| | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849720 https://bugzilla.novell.com/show_bug.cgi?id=849720#c3 Michal Vyskocil changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |krahmer@suse.com --- Comment #3 from Michal Vyskocil 2013-11-11 15:17:52 UTC --- (In reply to comment #2)

However then their logic is still weird, as then there dont need to be PRIV_START/PRIV_END.

I do see only one reason - to create files with the same user id, which belongs to caller of at command. However I've changed permissions such way and have added a debug patch listing uid/euid/gid/egid. But it did not work as I've expected # ls -lh /usr/bin/at -rwsr-sr-x 1 root trusted 52K Nov 11 15:39 /usr/bin/at # ls -ld /var/spool/atjobs/ drw-rw---- 1 at trusted 8 Nov 11 15:40 /var/spool/atjobs/ # getent group | grep trusted trusted:x:42: $ at 0000 warning: commands will be executed using /bin/sh DEBUG: uid:10112, euid:10112, gid:100, egid:42 Cannot create atjob file /var/spool/atjobs/a00004016005e4: Permission denied but process with egid trusted should be able to write to trusted group writable directory, or have I overlooked something? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849720 https://bugzilla.novell.com/show_bug.cgi?id=849720#c5 --- Comment #5 from Michal Vyskocil 2013-11-12 12:40:44 UTC --- Well, now at does work with -%verify(not mode) %attr(4750,root,trusted) %{_bindir}/at +%verify(not mode) %attr(6755,root,trusted) %{_bindir}/at -%attr(700,at,at) %dir /var/spool/atjobs +%attr(1770,at,trusted) %dir /var/spool/atjobs so the permissions package would need to be adapted as well. What does not work is atrm $ atrm 1 DEBUG: uid:25, euid:10112, gid:100, egid:25 Cannot unlink a000010160092c: Permission denied -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849720 https://bugzilla.novell.com/show_bug.cgi?id=849720#c7 Michal Vyskocil changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |krahmer@suse.com --- Comment #7 from Michal Vyskocil 2013-11-12 13:02:02 UTC --- (In reply to comment #5)

$ atrm 1 DEBUG: uid:25, euid:10112, gid:100, egid:25 Cannot unlink a000010160092c: Permission denied

This is weird, there is case ATRM: REDUCE_PRIV(daemon_uid, daemon_gid) whis does setreuid(10112, 0) setregid(100, 42) setregid(25, 100) setreuid(25, 10112) and with all *id munging afterward, we can't remove at job. In Debian this does work because they do have /usr/bin/at and /var/spool/cron/atjobs daemon:daemon, where SUSE's setup is very different. So it is obvious the code does expect very specific setup of at and jobs dir. The point is what to do know - to clone Debian's setup or to use an another way? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849720 https://bugzilla.novell.com/show_bug.cgi?id=849720#c9 --- Comment #9 from Michal Vyskocil 2013-11-12 15:48:10 UTC --- OK, implemented in https://build.opensuse.org/package/rdiff/Base:System/at?linkrev=base&rev=72 @fred: fixed at can be downloaded from http://download.opensuse.org/repositories/home:/mvyskocil:/branches:/Base:/S... feel free to test -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849720 https://bugzilla.novell.com/show_bug.cgi?id=849720#c11 --- Comment #11 from Bernhard Wiedemann 2013-11-13 11:00:10 CET --- This is an autogenerated message for OBS integration: This bug (849720) was mentioned in https://build.opensuse.org/request/show/206726 13.1 / at -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=849720 https://bugzilla.novell.com/show_bug.cgi?id=849720#c13 Michal Vyskocil changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED --- Comment #13 from Michal Vyskocil 2013-11-13 10:17:28 UTC --- closing the bug then -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.