From 811db9020a0ea737bb91281289903d350e862281 Mon Sep 17 00:00:00 2001
From: Matus Honek <mhonek@redhat.com>
Date: Mar 06 2020 17:13:05 +0000
Subject: Issue 50940 - Permissions of some shipped directories may change over time


Bug Description:
Some utilities (e.g. installer, esp. setup-ds.pl) alter permissions of
some folders shipped by default. This is discoverable by running
`rpm -V 389-ds-base` after using these.

Fix Description:
Adjust make-generated permissions from the autotools/FHS defaults to the
target permissions.

/var/lock/dirsrv is shipped in SPEC file only, thus it is adjusted only there.

Related: https://pagure.io/389-ds-base/issue/50940

Author: Matus Honek <mhonek@redhat.com>

Review By: Mark (thanks!)

---

diff --git a/Makefile.am b/Makefile.am
index 5d570aa..f7a1335 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -689,6 +689,13 @@ sbin_SCRIPTS = ldap/admin/src/scripts/ds_selinux_enabled \
 	ldap/admin/src/scripts/ds_selinux_port_query \
 	wrappers/ds_systemd_ask_password_acl
 
+install-data-hook:
+# Permissions of below directories would eventually be chmoded by setup tools.
+	chmod 775 $(DESTDIR)$(instconfigdir)
+	chmod 755 $(DESTDIR)$(configdir)
+	chmod 755 $(DESTDIR)$(schemadir)
+	chmod 775 $(DESTDIR)$(serverdir)
+
 if ENABLE_PERL
 sbin_SCRIPTS += ldap/admin/src/scripts/setup-ds.pl \
 	ldap/admin/src/scripts/migrate-ds.pl \
diff --git a/rpm/389-ds-base.spec.in b/rpm/389-ds-base.spec.in
index 4e2ffb3..ba64450 100644
--- a/rpm/389-ds-base.spec.in
+++ b/rpm/389-ds-base.spec.in
@@ -304,7 +304,8 @@ popd
 
 mkdir -p $RPM_BUILD_ROOT/var/log/%{pkgname}
 mkdir -p $RPM_BUILD_ROOT/var/lib/%{pkgname}
-mkdir -p $RPM_BUILD_ROOT/var/lock/%{pkgname}
+mkdir -p $RPM_BUILD_ROOT/var/lock/%{pkgname} \
+    && chmod 770 $RPM_BUILD_ROOT/var/lock/%{pkgname}
 
 # for systemd
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/%{groupname}.wants