random new SetFileProperty directives on /usr/bin and /etc/bluetooth

[Dieterbe]

recently, my "aconfmgr save" has resulted in this in the output:

SetFileProperty /etc/bluetooth mode 755
SetFileProperty /usr/bin group root
SetFileProperty /usr/bin owner root

this didn't used to be the case, and i certainly didn't mess with permissions or ownership of these paths.
running pacman -Qo /usr/bin shows all the packages that put anything in /usr/bin (741 packages!). as for bluetooth:

pacman -Qo /etc/bluetooth
/etc/bluetooth/ is owned by bluez 5.66-1
/etc/bluetooth/ is owned by bluez-utils 5.66-1

for bluetooth, it seems both these packages default to 555 now. see:
https://gitlab.archlinux.org/archlinux/packaging/packages/bluez/-/blob/main/PKGBUILD#L65

For /usr/bin, my guess is that one of these packages started setting (wrong) new owner/permissions, there might even be disagreement amongst the packages.
Interestingly, `pacman -Syu' does not seem to update ownership/permissions to match the new packages, such that aconfgr doesn't spot a difference?

When I remove the directives and run "aconfmgr apply --paranoid", i see this:

::: Configuring file properties...
:::: Comparing file properties...
::::: Done.
:::: Found 0 new, 0 changed, and 3 extra files properties.
::::: Proceed? [Y/n/d] 

It would be nice if aconfgr mentioned the diff here (package x says it should be y, but per your config it should be z) (adding -v does not show more)

[CyberShadow]

Yeah, there's an expectation that all directory attributes match across all packages, otherwise paccheck (and maybe pacman -k?) will complain that some package doesn't match.

I think this is a bug in the package.

Interestingly, `pacman -Syu' does not seem to update ownership/permissions to match the new packages, such that aconfgr doesn't spot a difference?

That may or may not be a pacman bug... in any case, aconfmgr apply with the SetFileProperty lines removed will make aconfmgr reset them to what's in the package (or one of them, at least).

It would be nice if aconfgr mentioned the diff here

I think pressing d will do that?

[Dieterbe]

I think pressing d will do that?

d'oh! i thought 'd' meant default (apply) :)

:::: Found 0 new, 0 changed, and 3 extra files properties.
::::: Proceed? [Y/n/d] d
::::: Clearing the following file properties:
:::::: Setting owner of /usr/bin to dieter (default value) <-- this seems quite strange
:::::: Setting mode of /etc/bluetooth to 555 (default value) <-- i guess i should do this to make it match what the package says
:::::: Setting group of /usr/bin to dieter (default value)
::::: Proceed? [Y/n/d] 

maybe pacman -k

are you referring to -Qk or -Dk ?

[CyberShadow]

Ah, yes, -Qk. It was added to pacman at some point and it's roughly a simple equivalent of paccheck.

[Dieterbe]

i chmodded /etc/bluetooth to 555 (we'll see how that goes), and kept the /usr/bin rules which presumably works around a broken package.
now 'save' is happy, and 'apply' says the below, it doesn't actually change /usr/bin, but this seems like the quickest way out of the issue.

:::: Found 2 new, 0 changed, and 0 extra files properties.
::::: Proceed? [Y/n/d] y
::::: Setting owner of /usr/bin to root
::::: Setting group of /usr/bin to root

[CyberShadow]

Okay, but I would still file a bug against the package that has directories with modes that mismatch the other packages.

paccheck should identify the problematic package.

[Dieterbe]

alas, it does not. i only have some errors due to something unrelated with a flutter package (let's ignore this in this conversation)

[root@xps17 dieter]# paccheck  | grep -vE 'all dependencies satisfied|all files match database|/opt/flutter/.pub-preload-cache.*missing file'
[root@xps17 dieter]# 
[root@xps17 dieter]# paccheck 2>&1 | sed 's/ all dependencies satisfied//' | sed 's/ all files match database//' | grep -v '^[-a-z0-9_\.\+]\+:$' | grep -v '/opt/flutter/.pub-preload-cache/'
flutter: '/opt/flutter/.pub-preload-cache' missing file
[root@xps17 dieter]# 

i also tried this:

[root@xps17 dieter]# pacman -Qk 2>&1 | sed -e 's/, 0 missing files//' -e 's/[0-9]\+ total files//' | grep -v '^[-a-z0-9_\.\+]\+: $'  | grep -v '/opt/flutter/.pub-preload-cache'
flutter: , 142 missing files

[CyberShadow]

Sorry, I should have mentioned that paccheck needs to be invoked with the same flags as aconfmgr: --files --file-properties --backup --noupgrade --md5sum. This will give you the same output that aconfmgr uses to know what changed on the system relative to the set of installed packages. (When there are conflicts, this output can never be empty.)

[Dieterbe]

bingo! it was an aur package. bug reported here sudoforge/pkgbuilds#92

thanks for your quick advice @CyberShadow , much appreciated!