summaryrefslogtreecommitdiff
path: root/dh_fixperms
blob: 6ef0905cfe20705c621071e77e8cda80a05501ce (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
#!/usr/bin/perl -w

=head1 NAME

dh_fixperms - fix permissions of files in package build directories

=cut

use strict;
use Debian::Debhelper::Dh_Lib;

=head1 SYNOPSIS

B<dh_fixperms> [S<I<debhelper options>>] [B<-X>I<item>]

=head1 DESCRIPTION

dh_fixperms is a debhelper program that is responsible for setting the
permissions of files and directories in package build directories to a
sane state -- a state that complies with Debian policy.

dh_fixperms makes all files in usr/share/doc in the package build directory
(excluding files in the examples/ directory) be mode 644. It also changes
the permissions of all man pages to mode 644. It makes all files be owned
by root, and it removes group and other write permission from all files. It
removes execute permissions from any libraries that have it set. It makes
all files in bin/ directories, /usr/games/ and etc/init.d executable (v4
only). Finally, it removes the setuid and setgid bits from all files in the
package.

=head1 OPTIONS

=over 4

=item B<-X>I<item>, B<--exclude> I<item>

Exclude files that contain "item" anywhere in their filename from having
their permissions changed. You may use this option multiple times to build
up a list of things to exclude.

=back

=cut

init();

foreach my $package (@{$dh{DOPACKAGES}}) {
	my $tmp=tmpdir($package);

	my $find_options='';
	if (defined($dh{EXCLUDE_FIND}) && $dh{EXCLUDE_FIND} ne '') {
		$find_options="! \\( $dh{EXCLUDE_FIND} \\)";
	}

	# General permissions fixing.
	complex_doit("find $tmp $find_options -print0",
		"2>/dev/null | xargs -0r chown --no-dereference 0:0");
	complex_doit("find $tmp ! -type l $find_options -print0",
		"2>/dev/null | xargs -0r chmod go=rX,u+rw,a-s");
	
	# Fix up premissions in usr/share/doc, setting everything to not
	# executable by default, but leave examples directories alone.
	complex_doit("find $tmp/usr/share/doc -type f $find_options ! -regex '$tmp/usr/share/doc/[^/]*/examples/.*' -print0 2>/dev/null",
		"| xargs -0r chmod 644");
	complex_doit("find $tmp/usr/share/doc -type d $find_options -print0 2>/dev/null",
		"| xargs -0r chmod 755");

	# Executable man pages are a bad thing..
	complex_doit("find $tmp/usr/share/man $tmp/usr/man/ $tmp/usr/X11*/man/ -type f",
		"$find_options -print0 2>/dev/null | xargs -0r chmod 644");

	# ..and so are executable shared and static libraries 
	# (and .la files from libtool) ..
	complex_doit("find $tmp -perm -5 -type f",
		"\\( -name '*.so*' -or -name '*.la' -or -name '*.a' \\) $find_options -print0",
		"2>/dev/null | xargs -0r chmod 644");
	
	# ..and header files ..
	complex_doit("find $tmp/usr/include  -type f $find_options -print0",
		"2>/dev/null | xargs -0r chmod 644");
	
	# .. and perl modules.
	complex_doit("find $tmp/usr/lib/perl5 $tmp/usr/share/perl5 -type f",
		"-perm -5 -name '*.pm' $find_options -print0",
		"2>/dev/null | xargs -0r chmod a-X");
	
	# v4 and up
	if (! compat(3)) {
		# Programs in the bin and init.d dirs should be executable..
		for my $dir (qw{usr/bin bin usr/sbin sbin usr/games etc/init.d}) {
			if (-d "$tmp/$dir") {
				complex_doit("find $tmp/$dir -type f $find_options -print0 2>/dev/null",
					"| xargs -0r chmod a+x");
			}
		}
	}
	
	# ADA ali files should be mode 444 to avoid recompilation
	if (-d "$tmp/usr/lib/ada") {
		complex_doit("find $tmp/usr/lib/ada -type f",
			"-name '*.ali' $find_options -print0",
			"2>/dev/null | xargs -0r chmod uga-w");
	}
}

=head1 SEE ALSO

L<debhelper(7)>

This program is a part of debhelper.

=head1 AUTHOR

Joey Hess <joeyh@debian.org>

=cut