From a95e28e5cb10d417c81c8720e8521eb63793da37 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 16 May 2016 15:25:53 -0400 Subject: [PATCH 14/29] Actually setfacl /each/ directory of our key storage. Signed-off-by: Peter Jones --- src/pesign-authorize-groups | 6 +++--- src/pesign-authorize-users | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/pesign-authorize-groups b/src/pesign-authorize-groups index a4f895e..cf51fb6 100644 --- a/src/pesign-authorize-groups +++ b/src/pesign-authorize-groups @@ -18,10 +18,10 @@ if [ -r /etc/pesign/groups ]; then setfacl -m g:${group}:rw /var/run/pesign/socket fi fi - for x in /etc/pki/pesign* ; do + for x in /etc/pki/pesign*/ ; do if [ -d ${x} ]; then - setfacl -m g:${group}:rx /etc/pki/pesign - for y in ${x}/{cert8,key3,secmod}.db ; do + setfacl -m g:${group}:rx ${x} + for y in ${x}{cert8,key3,secmod}.db ; do setfacl -m g:${group}:rw ${y} done fi diff --git a/src/pesign-authorize-users b/src/pesign-authorize-users index 8b9a885..940138e 100644 --- a/src/pesign-authorize-users +++ b/src/pesign-authorize-users @@ -18,10 +18,10 @@ if [ -r /etc/pesign/users ]; then setfacl -m g:${username}:rw /var/run/pesign/socket fi fi - for x in /etc/pki/pesign* ; do + for x in /etc/pki/pesign*/ ; do if [ -d ${x} ]; then - setfacl -m g:${username}:rx /etc/pki/pesign - for y in ${x}/{cert8,key3,secmod}.db ; do + setfacl -m g:${username}:rx ${x} + for y in ${x}{cert8,key3,secmod}.db ; do setfacl -m g:${username}:rw ${y} done fi -- 2.13.4