opencryptoki: patch out the recursive chmod -R in pkcs_slot, and bump ebuild.

Patch out the recursive chmod -R in pkcs_slot, and bump ebuild.

BUG=7289
TEST=Manual. Create /var/lib/opencryptoki/foo mode 644. Log out and
log in and confirm that it is still mode 644.

Change-Id: Iabb5996bccafcdc994429e18783a885000f49f13

Committed: http://chrome-svn/viewvc/chromeos?view=rev&revision=be4f8ae

[Nathan Williams, 2010-10-05 18:15:28]

Let's give this another try.

[rginda, 2010-10-05 20:13:53]

On 2010/10/05 18:15:28, Nathan Williams wrote:
> Let's give this another try.

I think the code was there to make sure subdirectories were g+rwx, and it was
just sloppy about it.  How about using `find -type d` or something similar to
scope the chmod to directories only?

[Nathan Williams, 2010-10-05 20:25:48]

For the directories it's creating? What would you think about putting 'umask
002' at the top of the script, so they're created with the right group
permissions in the first place?
(Noting, of course, that in our environment this script isn't ever going to make
directories, since the caller has already done that).

[rginda, 2010-10-05 20:45:11]

On 2010/10/05 20:25:48, Nathan Williams wrote:
> For the directories it's creating? What would you think about putting 'umask
> 002' at the top of the script, so they're created with the right group
> permissions in the first place?
> (Noting, of course, that in our environment this script isn't ever going to
make
> directories, since the caller has already done that).

Mm, good point, but will our script get the permissions right?

[Nathan Williams, 2010-10-05 21:17:57]

On 2010/10/05 20:45:11, rginda wrote:
> Mm, good point, but will our script get the permissions right?

Our script runs with umask 022, so /var/lib/opencryptoki/tpm gets created mode
755, not 775. Of course, its only contents are symlinks to the user's home
directory, which our script also created, so we don't need it to have group
write permission.

I think 'umask 002' is the right upstreamable change to the pkcs_slot script,
which avoids the business of chmod'ing random other files or directories. Any
further bugs with the permissions of the directories in this area would belong
to fix_pkcs11_token.sh, but it looks like we're currently OK.

PTAL.

[rginda, 2010-10-05 21:19:45]

Ok then, LGTM.  Thanks!

On 2010/10/05 21:17:57, Nathan Williams wrote:
> On 2010/10/05 20:45:11, rginda wrote:
> > Mm, good point, but will our script get the permissions right?
> 
> Our script runs with umask 022, so /var/lib/opencryptoki/tpm gets created mode
> 755, not 775. Of course, its only contents are symlinks to the user's home
> directory, which our script also created, so we don't need it to have group
> write permission.
> 
> I think 'umask 002' is the right upstreamable change to the pkcs_slot script,
> which avoids the business of chmod'ing random other files or directories. Any
> further bugs with the permissions of the directories in this area would belong
> to fix_pkcs11_token.sh, but it looks like we're currently OK.
> 
> PTAL.