Package: cups-pdf
Severity: normal
Tags: patch
Dear Maintainer,
The postinst script contains:
chown root:lpadmin /var/log/cups/*
This changes the group ownership of every non-hidden entry in
/var/log/cups, including files owned and managed by cups-daemon, such
as access_log, error_log and page_log.
These files may normally be owned by root:lp. Changing them to
root:lpadmin can override the permissions established by CUPS,
logrotate, dpkg-statoverride, or the local administrator. It can also
cause the group ownership to alternate between root:lp and
root:lpadmin after package upgrades, CUPS restarts, or log rotation.
The original purpose of this code appears to have been to fix the
ownership of cups-pdf's own log files. Older Debian packaging used:
chown root:lpadmin /var/log/cups/cups-pdf_log*
The command was later broadened to a recursive chown of /var/log/cups,
and was eventually changed to the current wildcard form in response to
a Lintian warning about recursive chown. There does not appear to be a
reason for cups-pdf to modify logs belonging to cups-daemon.
Suggested fix:
- chown root:lpadmin /var/log/cups/*
+ chown root:lpadmin /var/log/cups/cups-pdf_log*
The existing chmod command is already limited to cups-pdf_log*.
Regards,
Jiang Dingyuan
