<div dir="ltr">Well, the diff is between the RPM and the zipfile is pretty long, but it boils down to the 3 set of differences I've pointed out on <a href="https://issues.jboss.org/browse/WFLY-9574">WFLY-9574:</a><br><ul><li><b>.properties and .jar</b> files are associated with the mask rw-rw-r-- giving access to it to any other users and allowing group member to modify the file - the RPM distribution fixes that by removing the write privileges for the group (rw-r--r--). I personnaly don't see the value of letting the group members modify those files, I just can see how this could be exploited, so I would say it falls into "clearly wrong and not our intent". A case might be made for the .properties files, but for jars file I really don't see a valid use case (unless of course, any of you know one) ;<br></li><li><b>some directories</b> like 'domain/tmp/auth' have too restrictive mask like rwx------ and RPMS to turned them into rwxrwxr-x (that I don't really agree with) and</li><li><b>other directories</b>, likes 'domain' have again a too permissive mask rwxrwxr-x (should be rwxr-xr-x) - and this IMHO, make senses.</li></ul><p>So we need to find an agreement on those three items, and then see how we proceed to implement the fix (if needed).<br></p></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Nov 28, 2017 at 10:00 PM, Brian Stansberry <span dir="ltr"><<a href="mailto:brian.stansberry@redhat.com" target="_blank">brian.stansberry@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I think we need to start with the assumption that the permissions we have in the zip are the way they are for a reason and evaluate possible changes based on discussion here of each type of change. Maybe the RPM settings are better, maybe they are not. Or maybe they are better but the improvement is not worth the disruption a change may cause to our end users, who may rely on the current zip settings. Or maybe what we have in the zip is clearly wrong and doesn't follow our own intent. I expect we'll probably see a little of each category, although hopefully some changes for WF 11 removed the "clearly wrong and doesn't follow our intent" cases. :)</div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Tue, Nov 28, 2017 at 8:37 AM, Romain Pelisse <span dir="ltr"><<a href="mailto:belaran@redhat.com" target="_blank">belaran@redhat.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr">Hi,<br><br>As reported on JBEAP-12374[1], there is some discrepancies between the ZIP file we provided for Widlfy/EAP and the RPM generate. Most of those discrepancies - or the most relevant ones, are some fine tuning performed on the (POSIX) privileges (things such as removing the write privilege for member of the same group as the owner of the file). <br><br>I've looked into this and because those files are produced by our own Maven plugin (as part of wildfly-build-tools), we can not simply modify the assembly.xml. Which actually is probably for the best, as it would made the assembly file quite cumbersome.<br><br>Anyhow, I've worked on a proposal[2] for the wildfly-build-tools, but when I reported the problem on WFLY-9574[3], Brian suggested I started a discussion here. So does anyone have a (strong) opinion about this issue and/or how to resolve it ? :)<br><br>(For the record, I do think it is best to fix the privileges to follow what the RPM does for us for now, but if you feel this issue should not be addressed, and dev- the issue, I'm certainly not opposed to it either).<br><br>[1] <a href="https://issues.jboss.org/browse/JBEAP-12374" target="_blank">https://issues.jboss.org/brows<wbr>e/JBEAP-12374</a><br>[2] <a href="https://github.com/wildfly/wildfly-build-tools/pull/40" target="_blank">https://github.com/wildfly/wil<wbr>dfly-build-tools/pull/40</a><br>[3] <a href="https://issues.jboss.org/browse/WFLY-9574" target="_blank">https://issues.jboss.org/brows<wbr>e/WFLY-9574</a><br></div>
<br></div></div><span class="">______________________________<wbr>_________________<br>
wildfly-dev mailing list<br>
<a href="mailto:wildfly-dev@lists.jboss.org" target="_blank">wildfly-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/wildfly-dev" rel="noreferrer" target="_blank">https://lists.jboss.org/mailma<wbr>n/listinfo/wildfly-dev</a><br></span></blockquote></div><span class="HOEnZb"><font color="#888888"><br><br clear="all"><div><br></div>-- <br><div class="m_-5783924410412555088gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Brian Stansberry<div>Manager, Senior Principal Software Engineer</div><div>Red Hat</div></div></div>
</font></span></div>
</blockquote></div><br></div>