ec2 images have /etc with group write

[Jamie Strandboge]

Logging into EC2, I see /etc has group write:
$ ls -ld /etc
drwxrwxr-x 88 root root 4096 2012-03-15 14:02 /etc

Since this is group 'root', it is not security sensitive, however /etc should use the standard 755 and this might be indicative of a larger problem with image creation. (Debugging note: the default umask changed in 11.10).

[Ben Howard (darkmuggle-deactivatedaccount)]

It looks like this change was introduced with the switch over to Live-Build from VMBuilder. From a quick review of the code, the chmod's don't happen anywhere near /etc.

Confirmed for both Precise and Oneiric.

[Scott Moser (smoser)]

Just for information, I just rand this on my mirror of cloud-images:
$ sudo sh -c 'tmpd=$(mktemp -d); for tarball in $(find -type f -name "*server*-i386.tar.gz" | sort); do echo === "$(date +%H:%M:%S): $tarball" === ; ( cd "$tmpd" && rm -rf * && tar -Sxzf - && mkdir mp && sudo mount -o loop *.img mp && ls -ld mp/etc ) < $tarball ; ret=$?; sudo umount $tmpd/mp ; [ $ret -eq 0 ] || { echo "FAILED" ; break; } ; done 2>&1 '| tee /tmp/out.log

Attaching the output.

It seems to have come in at oneiric alpha-3.

[Ben Howard (darkmuggle-deactivatedaccount)]

Fascinating. Tracking this down was pretty tricky. The root cause is the file permissions of live-config/common/includes.chroot/etc was 0777. By chaning the permissions on the bzr branch, a non-prod test build had the proper permissions.

I push r462, which fixes this problem and am putting through a prod-test build now.
lp:~ubuntu-on-ec2/vmbuilder/automated-ec2-builds

[Ben Howard (darkmuggle-deactivatedaccount)]

Fix is present in the latest dailies. Marking as fix-released.