overrides: fast-track rpm-ostree-2024.4-6.fc39

manifest-lock.overrides.yaml

@@ -8,4 +8,16 @@
 # in the `metadata.reason` key, though it's acceptable to omit a `reason`
 # for FCOS-specific packages (ignition, afterburn, etc.).
 
-packages: {}
+packages:
+  rpm-ostree:
+    evr: 2024.4-6.fc39
+    metadata:
+      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2024-4afd3d38ae
+      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1705
+      type: fast-track
+  rpm-ostree-libs:
+    evr: 2024.4-6.fc39
+    metadata:
+      bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2024-4afd3d38ae
+      reason: https://github.com/coreos/fedora-coreos-tracker/issues/1705
+      type: fast-track

tests/kola/files/etc-permissions

@@ -0,0 +1,44 @@
+#!/bin/bash
+## kola:
+##   exclusive: false
+##   description: Verify that /etc/(passwd|group|shadow|gshadow) have correct permissions.
+
+set -xeuo pipefail
+
+# shellcheck disable=SC1091
+. "$KOLA_EXT_DATA/commonlib.sh"
+
+incorrect=""
+for f in '/etc/passwd' '/etc/group'; do
+    if [[ $(stat --format="%a %u %g" "${f}") != "644 0 0" ]]; then
+        incorrect+=" ${f}"
+    fi
+done
+for f in '/etc/passwd-' '/etc/group-'; do
+    if [[ -f "${f}" ]]; then
+        if [[ $(stat --format="%a %u %g" "${f}") != "644 0 0" ]]; then
+            incorrect+=" ${f}"
+        fi
+    fi
+done
+for f in '/etc/shadow' '/etc/gshadow'; do
+    if [[ $(stat --format="%a %u %g" "${f}") != "0 0 0" ]]; then
+        incorrect+=" ${f}"
+    fi
+done
+for f in '/etc/shadow-' '/etc/gshadow-'; do
+    if [[ -f "${f}" ]]; then
+        if [[ $(stat --format="%a %u %g" "${f}") != "0 0 0" ]]; then
+            incorrect+=" ${f}"
+        fi
+    fi
+done
+
+if [[ -n "${incorrect}" ]]; then
+    # We explicitely want to split on whitespace here
+    # shellcheck disable=SC2086
+    ls -al ${incorrect}
+    fatal "found incorrect permissions for: ${incorrect}"
+fi
+
+ok "correct ownership and mode on /etc/passwd, /etc/group, /etc/shadow and /etc/gshadow"