Install root backends world-readable

This is needed:
 - to comply with Debian Policy
 - because it is both nonsensical to not do so
 - it also breaks system checkers, bug reporting, etc

Bug: https://github.com/apple/cups/issues/2935
Bug-Debian: https://bugs.debian.org/410171
Patch-Name install-root-backends-world-readable.patch

diff --git a/backend/Makefile b/backend/Makefile
index 01900fb8b2ea2c6706649caa9fc46d1aed615383..8ddf6abbde53d9535cb09f1a4b8815da5a33925c 100644 (file)
--- a/backend/Makefile
+++ b/backend/Makefile
@@ -13,7 +13,7 @@ include ../Makedefs
 # Object files...
 #
 
-# RBACKENDS are installed mode 0700 so cupsd will run them as root...
+# RBACKENDS are installed mode 0744 so cupsd will run them as root...
 #
 # UBACKENDS and ULBACKENDS are installed mode 0755 so cupsd will run them as
 # an unprivileged user...
@@ -118,7 +118,7 @@ install-exec:       $(INSTALLXPC)
        echo Installing backends in $(SERVERBIN)/backend
        $(INSTALL_DIR) -m 755 $(SERVERBIN)/backend
        for file in $(RBACKENDS); do \
-               $(INSTALL_BIN) -m 700 $$file $(SERVERBIN)/backend; \
+               $(INSTALL_BIN) -m 744 $$file $(SERVERBIN)/backend; \
        done
        for file in $(UBACKENDS); do \
                $(INSTALL_BIN) $$file $(SERVERBIN)/backend; \

diff --git a/scheduler/cups-deviced.c b/scheduler/cups-deviced.c
index 77703b98330bbf8f985871033c4dc3aa929d3b9a..14478fd990afece7781fbff3efeeaf966cd1edf7 100644 (file)
--- a/scheduler/cups-deviced.c
+++ b/scheduler/cups-deviced.c
@@ -265,7 +265,7 @@ main(int  argc,                             /* I - Number of command-line args */
     * all others run as the unprivileged user...
     */
 
-    start_backend(dent->filename, !(dent->fileinfo.st_mode & (S_IWGRP | S_IRWXO)));
+    start_backend(dent->filename, !(dent->fileinfo.st_mode & (S_IWGRP | S_IWOTH | S_IXOTH)));
   }
 
   cupsDirClose(dir);

diff --git a/scheduler/job.c b/scheduler/job.c
index 17b341834cbe5e52ba7608ea783d75b151b79e05..7f35a0e70cf56c0d86b50e72a2a14624615b8587 100644 (file)
--- a/scheduler/job.c
+++ b/scheduler/job.c
@@ -1247,7 +1247,7 @@ cupsdContinueJob(cupsd_job_t *job)        /* I - Job */
       else if (stat(command, &backinfo))
        backroot = 0;
       else
-        backroot = !(backinfo.st_mode & (S_IWGRP | S_IRWXO));
+        backroot = !(backinfo.st_mode & (S_IWGRP | S_IWOTH | S_IXOTH));
 
       argv[0] = job->printer->sanitized_device_uri;