Restore certificates permission on RW area

* cert-svc needs same DAC to read certificates on RW.
* TZ_SYS_CA_CERTS should have read permission for others.

Change-Id: I4eecba97817b3853b48f432f1da4a850a8ac6a17
Signed-off-by: sangwan.kwon <sangwan.kwon@samsung.com>

diff --git a/packaging/ca-certificates.spec b/packaging/ca-certificates.spec
index ced87bd..8cac579 100644 (file)
--- a/packaging/ca-certificates.spec
+++ b/packaging/ca-certificates.spec
@@ -121,8 +121,8 @@ cp %{buildroot}%{ca_bundle} %{buildroot}%{upgrade_data_dir}
 # symbol Certificates : R0 area
 %dir %{ro_ca_certs_dir}
 # symbol Certificates : RW area
-%dir %attr(770, %{user_name}, %{group_name}) %{ca_certs_dir}
-%{ca_certs_dir}/*
+%dir %attr(775, %{user_name}, %{group_name}) %{ca_certs_dir}
+%attr(444, %{user_name}, %{group_name}) %{ca_certs_dir}/*
 # original CA bundle
 %dir %{ca_bundle_dir}
 %attr(664, root, %{group_name}) %{ca_bundle}

diff --git a/scripts/ca-certificates-certs-upgrade.sh.in b/scripts/ca-certificates-certs-upgrade.sh.in
index 7ad49f0..76f1041 100644 (file)
--- a/scripts/ca-certificates-certs-upgrade.sh.in
+++ b/scripts/ca-certificates-certs-upgrade.sh.in
@@ -29,7 +29,7 @@ ln -sf @TZ_SYS_RO_CA_CERTS_ORIG@/* @TZ_SYS_CA_CERTS@/
 chsmack -a @SMACK_DOMAIN_NAME@ @TZ_SYS_CA_CERTS@
 
 # change DAC
-chown @USER_NAME@:@GROUP_NAME@ @TZ_SYS_CA_CERTS@
+chown -h -R @USER_NAME@:@GROUP_NAME@ @TZ_SYS_CA_CERTS@
 
 # change mode
-chmod 770 @TZ_SYS_CA_CERTS@
+chmod 775 @TZ_SYS_CA_CERTS@