Bug#859318: pyracerz: Games crashes with Permission denied when writing highscores

[James Cowgill]

Hi,

On 02/04/17 17:26, Markus Koschany wrote:
> Am 02.04.2017 um 17:52 schrieb James Cowgill:
>> On 02/04/17 14:38, Markus Koschany wrote:
>>> Am 02.04.2017 um 09:33 schrieb Andrej Mernik:
>>>> Package: pyracerz
>>>> Version: 0.2-8
>>>> Severity: normal
>>>>
>>>> Dear Maintainer,
>>>>
>>>> the game crashes when it tries to write the highscore file:
>>>>
>>>> Traceback (most recent call last):
>>>>   File "/usr/games/pyracerz", line 280, in <module>
>>>>     if __name__ == '__main__': main()
>>>>   File "/usr/games/pyracerz", line 251, in main
>>>>     challenge.Challenge(thePlayer)
>>>>   File "/usr/share/games/pyracerz/modules/challenge.py", line 65, in __init__
>>>>     chrono = chalRace.play()
>>>>   File "/usr/share/games/pyracerz/modules/game.py", line 550, in play
>>>>     self.computeScores(currentTrack)
>>>>   File "/usr/share/games/pyracerz/modules/game.py", line 613, in computeScores
>>>>     if misc.addHiScore(track, play) == 1:
>>>>   File "/usr/share/games/pyracerz/modules/misc.py", line 185, in addHiScore
>>>>     fwrite = file("/var/games/pyracerz/pyracerz.conf", "w+")
>>>> IOError: [Errno 13] Permission denied: '/var/games/pyracerz/pyracerz.conf'
>>>>
>>>>
>>>> $ ls -al /var/games/pyracerz/pyracerz.conf
>>>> -rw-rw-r-- 1 root games 1208 apr  2 08:48 /var/games/pyracerz/pyracerz.conf
>>>
>>> Your user must be a member of group "games". I think the error handling
>>> can be improved but otherwise this works as intended.
>>
>> No. The "games" group is for allowing high scores to be stored in
>> /var/games.
> 
> That's exactly the point here. He can't write the highscore to
> /var/games/pyracerz/pyracerz.conf because he does not have write access
> to it. In order to write to this file you must be a member of group
> games. Works fine for me.

The point is that no user should ever need to be a member of the games
group and I expect 99% of all users who want to run pyracerz are not.

By your argument, why does pyracerz's postinst contain code to make
pyracerz setgid?

James

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-games-devel/attachments/20170402/201539ba/attachment-0001.sig>