[BUG] Anaconda create /boot/efi partiton fsopts with umask=077, should create with dmask=0077,fmask=0177

[makhomed]

BUG:

all text files ab UEFI blobs are displayed as executable scripts / binaries inside /boot/efi/ directory.

expected:

only directories should have permissions 0700, and all BLOBs and text files must have 0600 permissions.

how to fix:

fragment of file anaconda/pyanaconda/modules/storage/partitioning/custom/custom_partitioning.py

        elif partition_data.mountpoint == "/boot/efi":
            ty = "EFI System Partition"
            partition_data.fsopts = "defaults,uid=0,gid=0,umask=077,shortname=winnt"

proposed patch:

-           partition_data.fsopts = "defaults,uid=0,gid=0,umask=077,shortname=winnt"
+           partition_data.fsopts = "defaults,uid=0,gid=0,dmask=0077,fmask=0177,shortname=winnt"

also shim-x64-15.8-2.el9.x86_64.rpm and grub2-efi-x64-2.06-92.el9.x86_64 should be rebuild and strip executable bit from all files inside /boot/efi/ directory.

to remove all text and binary files inside /boot/efi/ from the rpm -Va command output.

P.S.

what is the proper way to fix this bug in the Anaconda installer and shim-x64-15.8-2.el9.x86_64.rpm and grub2-efi-x64-2.06-92.el9.x86_64 packages?

I need to write separate bug reports in the some other bug tracker?

about CentOS Stream, RHEL 10, RHEL 9, RHEL 8, ...

to fix this Anaconda bug and /boot/efi/ file permissions inside rpm packages bug also in all these distros?

[jkonecny12]

Hi, for Fedora you don't necessary need a bug filed even thought, it's preferred to have it filed here https://bugzilla.redhat.com/. You can instead of proposing a bug just make a contribution.

For RHEL and CentOS Stream these bugs should be filed to https://issues.redhat.com/projects/RHEL/