jordansissel/fpm — Issue #121: rpm packages dangerously set permissions on /
Author: ohookins
Created: 2011-11-16 23:03:24+00:00
State: open

In lib/fpm/package.rb:

```ruby
143 def render_spec
144 # find all files in paths given.
145 paths = []
146 @source.paths.each do |path|
147 Find.find(path) { |p| paths << p }
148 end
```
This will include the containing directory, which, being stripped of its leading components will end up as / - in other words the root of the filesystem will be included in every RPM package generated (not desirable).

In templates/rpm.erb:

```ruby
93 %files
94 %defattr(-,root,root,-)
95 <%# Trim leading '.' from paths if they are './blah...' -%>
96 <%# Also ensure paths start with '/' -%>
97 <%= @source.paths.collect { |p| p.gsub(/^\.\//, "/").gsub(/^[^\/]/, "/\\0") }.join("\n") %>
```

Files are just being added without further logic from the tarball, which I believe just preserves the permissions that were on the files when they were handed over to fpm.

The workaround is to ensure you have the root of your -C directory set to 755 but it seems unnecessarily risky to include it given the mayhem that can break loose when you install a broken package like this.