From 0df758bbb282f9d4a81818b6f7816eb0eb663519 Mon Sep 17 00:00:00 2001

From: Peter Jones <pjones@redhat.com>

Date: Mon, 16 May 2016 15:25:53 -0400

Subject: [PATCH 15/15] Actually setfacl /each/ directory of our key storage.

Signed-off-by: Peter Jones <pjones@redhat.com>

(cherry picked from commit f0c285fe74f00402acb72cb4ae91891006e9cfa4)

---

 src/pesign-authorize-groups | 6 +++---

 src/pesign-authorize-users  | 6 +++---

 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/pesign-authorize-groups b/src/pesign-authorize-groups

index a4f895e..cf51fb6 100644

--- a/src/pesign-authorize-groups

+++ b/src/pesign-authorize-groups

@@ -18,10 +18,10 @@ if [ -r /etc/pesign/groups ]; then

 		setfacl -m g:${group}:rw /var/run/pesign/socket

 	    fi

 	fi

-	for x in /etc/pki/pesign* ; do

+	for x in /etc/pki/pesign*/ ; do

 	    if [ -d ${x} ]; then

-		setfacl -m g:${group}:rx /etc/pki/pesign

-		for y in ${x}/{cert8,key3,secmod}.db ; do

+		setfacl -m g:${group}:rx ${x}

+		for y in ${x}{cert8,key3,secmod}.db ; do

 		    setfacl -m g:${group}:rw ${y}

 		done

 	    fi

diff --git a/src/pesign-authorize-users b/src/pesign-authorize-users

index 8b9a885..940138e 100644

--- a/src/pesign-authorize-users

+++ b/src/pesign-authorize-users

@@ -18,10 +18,10 @@ if [ -r /etc/pesign/users ]; then

 		setfacl -m g:${username}:rw /var/run/pesign/socket

 	    fi

 	fi

-	for x in /etc/pki/pesign* ; do

+	for x in /etc/pki/pesign*/ ; do

 	    if [ -d ${x} ]; then

-		setfacl -m g:${username}:rx /etc/pki/pesign

-		for y in ${x}/{cert8,key3,secmod}.db ; do

+		setfacl -m g:${username}:rx ${x}

+		for y in ${x}{cert8,key3,secmod}.db ; do

 		    setfacl -m g:${username}:rw ${y}

 		done

 	    fi

-- 

2.5.5