[Debian-ha-maintainers] Bug#1082433: drbd-utils: Permission mismatch for /var/lock/ directory

[Guillem Jover]

Package: drbd-utils
Version: 9.22.0-1.1
Severity: important
X-Debbugs-Cc: Helmut Grohne <helmut at subdivi.de>

Hi!

While analyzing the archive for mismatched file metadata (as part of
the preparation to add support into dpkg), thanks to Helmut gathering
the data from the archive. I noticed that this package has a mismatch
in the permissions for the /var/lock/ directory compared to the
canonical permissions from base-files. The permissions of a directory
are decided by the first package being unpacked, and subsequent
directory unpacks get currently ignored (including any change in
permissions).

  $ dpkg-deb -c base-files_13.5_amd64.deb | grep var/lock
  drwxrwxrwt root/root         0 2024-08-04 23:30 ./var/lock/
  $ dpkg-deb -c drbd-utils_9.22.0-1.1_amd64.deb | grep var/lock
  drwxr-xr-x root/root         0 2024-07-17 19:22 ./var/lock/

While in this case, it currently poses no problem as base-files is in
theory always to be installed first (assuming one does not do funny
stuff with a bootstrapping tool). This mismatch might become a problem
in the future once dpkg grows filesystem metadata tracking, and this
kind of condition becomes either a warning or an error, which could
make this package uninstallable.

In this case I think the best option is to simply stop shipping the
/var/lock directory.

Thanks,
Guillem