Bug#930128: tint: Error creating /var/games/tint.scores

[Asher Gordon]

Package: tint
Version: 0.05+b1
Followup-For: Bug #930128

Hi,

I've looked into this a bit more, and I've found commit a05fa0e30c (in
the Debian git repository [1]). This commit references #769296, which I
will now quote:

Ernest Adrogué <nfdisco at gmail.com> writes:

> As long as the player is in group "games" making tint.scores
> group-writeable should be enough to fix the problem.  No need to setgid
> the tint executable.

The maintainer (Ricardo Mones) documented this solution in
/usr/share/doc/tint/README.Debian. However, I think this solution is
inferior to making the binary setgid "games" for a couple reasons:

  a) Most games in Debian use the setgid method. I don't see why TINT
     should be any different.

  b) If a user is part of the "games" group, that user may tamper with
     the score file. If the binary is setgid "games", users may only
     write to the score file through TINT itself.

Looking at the moon buggy package, I believe the following patch should
make the binary setgid "games" (I tested it out on my machine and it
works):

-------------- next part --------------

Note that I have also removed README.Debian in the above patch because
it is no longer relevant.


Thanks,
Asher


P.S. I am going to attempt to add a patch tag to this bug (since I added
a patch), but I don't know if I have permission to do so, so it may not
work (I've never tried before).


Footnotes: 
[1]  https://salsa.debian.org/games-team/tint.git


-- 
: The following (relative to AutoSplit 1.03) attempts to please everyone
: and perhaps pleases no one:

I think that's way cool.
		-- Larry Wall in <199709292015.NAA09627 at wall.org>

GPG fingerprint: 38F3 975C D173 4037 B397  8095 D4C9 C4FC 5460 8E68
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-games-devel/attachments/20191209/8592e50d/attachment.sig>