diff -Nru frr-8.1/debian/changelog frr-8.1/debian/changelog --- frr-8.1/debian/changelog 2022-10-05 16:35:26.000000000 +0000 +++ frr-8.1/debian/changelog 2022-10-28 14:38:34.000000000 +0000 @@ -1,3 +1,11 @@ +frr (8.1-1ubuntu1.3) jammy; urgency=medium + + * d/frr.postinst: don't change log ownership if the syslog user + doesn't exist. Thanks to Alessandro Ratti + for the fix (LP: #1991812). + + -- Andreas Hasenack Fri, 28 Oct 2022 11:38:34 -0300 + frr (8.1-1ubuntu1.2) jammy-security; urgency=medium * SECURITY UPDATE: DoS via out-of-bounds read diff -Nru frr-8.1/debian/frr.postinst frr-8.1/debian/frr.postinst --- frr-8.1/debian/frr.postinst 2022-07-19 20:36:23.000000000 +0000 +++ frr-8.1/debian/frr.postinst 2022-10-28 14:38:34.000000000 +0000 @@ -50,26 +50,28 @@ # fix logging for Ubuntu, which does not run rsyslog as root (LP: #1958162), # and upgrades from quagga (what the block above used to do also for /var/log) -# frr user was created above, this really shouldn't fail -frruid=`getent passwd frr | cut -d : -f 3` -frrgid=`getent group frr | cut -d : -f 3` +if getent passwd syslog > /dev/null; then + # frr user was created above, this really shouldn't fail + frruid=`getent passwd frr | cut -d : -f 3` + frrgid=`getent group frr | cut -d : -f 3` -find \ - /var/log/frr \ - \( -uid 0 -o -uid $quaggauid -o -uid $frruid \) -a \ - \( -gid 0 -o -gid $quaggauid -o -gid $frrgid \) | \ - while read filename; do + find \ + /var/log/frr \ + \( -uid 0 -o -uid $quaggauid -o -uid $frruid \) -a \ + \( -gid 0 -o -gid $quaggauid -o -gid $frrgid \) | \ + while read filename; do - # don't chown anything that has ACLs (but don't fail if we don't - # have getfacl) - if { getfacl -c "$filename" 2>/dev/null || true; } \ - | egrep -q -v '^((user|group|other)::|$)'; then - : - else - chown syslog:adm "$filename" - chmod o-rwx "$filename" - fi -done + # don't chown anything that has ACLs (but don't fail if we don't + # have getfacl) + if { getfacl -c "$filename" 2>/dev/null || true; } \ + | egrep -q -v '^((user|group|other)::|$)'; then + : + else + chown syslog:adm "$filename" + chmod o-rwx "$filename" + fi + done +fi # fix misconfigured vtysh.conf & frr.conf ownership caused by config save # mishandling in earlier FRR (and Quagga) versions