{"action":"created","comment":{"url":"https://api.github.com/repos/basho/node_package/pulls/comments/56860387","id":56860387,"diff_hunk":"@@ -0,0 +1,51 @@\n+# node_package 3.0.0\n+## Security Improvements\n+### Introduction\n+### Security Advisory dated March 1, 2016\n+It was [recently reported](http://docs.basho.com/riak/latest/community/product-advisories/codeinjectioninitfiles/) that, if a user could gain access to the `riak` user (or, in node_package parlance, the `package_install_user`), that use would then have write access to init scripts that are generally run as `root`, exposing an escalation of privileges attack where said use could then get the `root` user to execute a script that could allow the original user to become `root` on the system.\n+\n+### Additional Security Review\n+\n+After the security advisory was initially released, a more through review of all of the `node_package`-generated packages was conducted. This review found some additional cases of files or directories owned by the `package_install_user` or `package_install_group` that could also potentially allow a user with access to run in the context of that user to overwrite files that may later be executed by `root`. This release of `node_package` has significantly tightened the ownership and permissions of files installed, in most cases following the target systems' conventions (`root:root`, `root:bin`, `root:wheel`) for all files that are executable or could be executed, including library files that the packaged application may read.\n+The [node_package](https://github.com/basho/node_package) library is used to build deployable packages for Erlang applications that target many operating systems. Node_package supports building installation packages for:\n+\n+- Redhat / Fedora and variants\n+- Debian / Ubuntu and variants\n+- FreeBSD\n+- OSX\n+- SmartOS\n+- Solaris\n+\n+### TL;DR - What should I do?\n+\n+#### You're a user updating a system (like Riak) installed by node_package:\n+\n+When upgrading from an older version of a system like Riak that uses node_package for installation, you may need to verify the following (note, the examples will be for a Centos 7-based Linux installation of Riak, but should illustrate the required checks for most OSes and similar packages):\n+\n+- Validate permissions on existing directories and make them owned by root:root (or the appropriate user/group for your operating system) and not writable by the package_install_user/group. For this example, we will list the specific directories for the Centos 7 install, and then their `node_package` template names in parenthesis afterward. Directories and files include:\n+\t- /usr/lib64/riak (`platform_lib_dir`)\n+\t- /etc/riak (`platform_etc_dir`)\n+\t- /usr/bin (`platform_bin_dir`), specifically\n+\t\t- riak\n+\t\t- riak-admin\n+\t\t- riak-debug\n+\t\t- riak-repl\n+\t\t- search-cmd\n+\t- /etc/init.d/riak (`platform_etc_dir`/init.d/`package_install_name`)\n+- Validate the home directory of the `platform_install_user` user is set to the `platform_data_dir`, in the case of Riak on Centos 7 this should be the `riak` user and the `/var/lib/riak` directory, and not `/usr/lib64/riak`. If necessary, change the home directory of the `riak` (`package_install_user`) user  to point to `/var/lib/riak` (`platform_data_dir`).\n+\n+#### You're an application maintainer that uses node_package to produce packages for your application:\n+\n+Please upgrade to version 3.0.0 of node_package and test your packaging/install process carefully. If you were depending on the writability of directories outside of the `platform_data_dir` you may need to adjust your application to store writable files in `platform_data_dir` rather than some other directory, like `package_root_dir`. \n+\n+Additionally, the home directory of the `package_install_user` has been normalized across platforms to be the `platform_data_dir`. If you somehow depended on the home directory to be set to `platform_base_dir` make appropriate changes to ensure your application can handle the change in home directory.","path":"RELEASE-NOTES.md","position":41,"original_position":41,"commit_id":"1bc15c3e42f256ef1b258560690a90d9f6438013","original_commit_id":"1bc15c3e42f256ef1b258560690a90d9f6438013","user":{"login":"laurenrother","id":2624486,"avatar_url":"https://avatars.githubusercontent.com/u/2624486?v=3","gravatar_id":"","url":"https://api.github.com/users/laurenrother","html_url":"https://github.com/laurenrother","followers_url":"https://api.github.com/users/laurenrother/followers","following_url":"https://api.github.com/users/laurenrother/following{/other_user}","gists_url":"https://api.github.com/users/laurenrother/gists{/gist_id}","starred_url":"https://api.github.com/users/laurenrother/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/laurenrother/subscriptions","organizations_url":"https://api.github.com/users/laurenrother/orgs","repos_url":"https://api.github.com/users/laurenrother/repos","events_url":"https://api.github.com/users/laurenrother/events{/privacy}","received_events_url":"https://api.github.com/users/laurenrother/received_events","type":"User","site_admin":false},"body":"Remove 'somehow' from that second sentence. :)","created_at":"2016-03-21T17:21:31Z","updated_at":"2016-03-21T17:21:31Z","html_url":"https://github.com/basho/node_package/pull/200#discussion_r56860387","pull_request_url":"https://api.github.com/repos/basho/node_package/pulls/200","_links":{"self":{"href":"https://api.github.com/repos/basho/node_package/pulls/comments/56860387"},"html":{"href":"https://github.com/basho/node_package/pull/200#discussion_r56860387"},"pull_request":{"href":"https://api.github.com/repos/basho/node_package/pulls/200"}}},"pull_request":{"url":"https://api.github.com/repos/basho/node_package/pulls/200","id":63474659,"html_url":"https://github.com/basho/node_package/pull/200","diff_url":"https://github.com/basho/node_package/pull/200.diff","patch_url":"https://github.com/basho/node_package/pull/200.patch","issue_url":"https://api.github.com/repos/basho/node_package/issues/200","number":200,"state":"open","locked":false,"title":"Add RELEASE-NOTES.md","user":{"login":"JeetKunDoug","id":682821,"avatar_url":"https://avatars.githubusercontent.com/u/682821?v=3","gravatar_id":"","url":"https://api.github.com/users/JeetKunDoug","html_url":"https://github.com/JeetKunDoug","followers_url":"https://api.github.com/users/JeetKunDoug/followers","following_url":"https://api.github.com/users/JeetKunDoug/following{/other_user}","gists_url":"https://api.github.com/users/JeetKunDoug/gists{/gist_id}","starred_url":"https://api.github.com/users/JeetKunDoug/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JeetKunDoug/subscriptions","organizations_url":"https://api.github.com/users/JeetKunDoug/orgs","repos_url":"https://api.github.com/users/JeetKunDoug/repos","events_url":"https://api.github.com/users/JeetKunDoug/events{/privacy}","received_events_url":"https://api.github.com/users/JeetKunDoug/received_events","type":"User","site_admin":false},"body":"With recent security/permissions changes, need to bump to 3.0.0. Included upgrade/update nodes for users and packagers.","created_at":"2016-03-19T18:18:54Z","updated_at":"2016-03-21T17:21:31Z","closed_at":null,"merged_at":null,"merge_commit_sha":"6a4e2db0546ea655f21fa9108b4f47810d9b6cf1","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/basho/node_package/pulls/200/commits","review_comments_url":"https://api.github.com/repos/basho/node_package/pulls/200/comments","review_comment_url":"https://api.github.com/repos/basho/node_package/pulls/comments{/number}","comments_url":"https://api.github.com/repos/basho/node_package/issues/200/comments","statuses_url":"https://api.github.com/repos/basho/node_package/statuses/1bc15c3e42f256ef1b258560690a90d9f6438013","head":{"label":"basho:dr/release_notes_3.0","ref":"dr/release_notes_3.0","sha":"1bc15c3e42f256ef1b258560690a90d9f6438013","user":{"login":"basho","id":176293,"avatar_url":"https://avatars.githubusercontent.com/u/176293?v=3","gravatar_id":"","url":"https://api.github.com/users/basho","html_url":"https://github.com/basho","followers_url":"https://api.github.com/users/basho/followers","following_url":"https://api.github.com/users/basho/following{/other_user}","gists_url":"https://api.github.com/users/basho/gists{/gist_id}","starred_url":"https://api.github.com/users/basho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/basho/subscriptions","organizations_url":"https://api.github.com/users/basho/orgs","repos_url":"https://api.github.com/users/basho/repos","events_url":"https://api.github.com/users/basho/events{/privacy}","received_events_url":"https://api.github.com/users/basho/received_events","type":"Organization","site_admin":false},"repo":{"id":1596440,"name":"node_package","full_name":"basho/node_package","owner":{"login":"basho","id":176293,"avatar_url":"https://avatars.githubusercontent.com/u/176293?v=3","gravatar_id":"","url":"https://api.github.com/users/basho","html_url":"https://github.com/basho","followers_url":"https://api.github.com/users/basho/followers","following_url":"https://api.github.com/users/basho/following{/other_user}","gists_url":"https://api.github.com/users/basho/gists{/gist_id}","starred_url":"https://api.github.com/users/basho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/basho/subscriptions","organizations_url":"https://api.github.com/users/basho/orgs","repos_url":"https://api.github.com/users/basho/repos","events_url":"https://api.github.com/users/basho/events{/privacy}","received_events_url":"https://api.github.com/users/basho/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/basho/node_package","description":"RPM/Debian/FreeBSD/SmartOS/Solaris/OSX packaging templates for Erlang Nodes","fork":false,"url":"https://api.github.com/repos/basho/node_package","forks_url":"https://api.github.com/repos/basho/node_package/forks","keys_url":"https://api.github.com/repos/basho/node_package/keys{/key_id}","collaborators_url":"https://api.github.com/repos/basho/node_package/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/basho/node_package/teams","hooks_url":"https://api.github.com/repos/basho/node_package/hooks","issue_events_url":"https://api.github.com/repos/basho/node_package/issues/events{/number}","events_url":"https://api.github.com/repos/basho/node_package/events","assignees_url":"https://api.github.com/repos/basho/node_package/assignees{/user}","branches_url":"https://api.github.com/repos/basho/node_package/branches{/branch}","tags_url":"https://api.github.com/repos/basho/node_package/tags","blobs_url":"https://api.github.com/repos/basho/node_package/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/basho/node_package/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/basho/node_package/git/refs{/sha}","trees_url":"https://api.github.com/repos/basho/node_package/git/trees{/sha}","statuses_url":"https://api.github.com/repos/basho/node_package/statuses/{sha}","languages_url":"https://api.github.com/repos/basho/node_package/languages","stargazers_url":"https://api.github.com/repos/basho/node_package/stargazers","contributors_url":"https://api.github.com/repos/basho/node_package/contributors","subscribers_url":"https://api.github.com/repos/basho/node_package/subscribers","subscription_url":"https://api.github.com/repos/basho/node_package/subscription","commits_url":"https://api.github.com/repos/basho/node_package/commits{/sha}","git_commits_url":"https://api.github.com/repos/basho/node_package/git/commits{/sha}","comments_url":"https://api.github.com/repos/basho/node_package/comments{/number}","issue_comment_url":"https://api.github.com/repos/basho/node_package/issues/comments{/number}","contents_url":"https://api.github.com/repos/basho/node_package/contents/{+path}","compare_url":"https://api.github.com/repos/basho/node_package/compare/{base}...{head}","merges_url":"https://api.github.com/repos/basho/node_package/merges","archive_url":"https://api.github.com/repos/basho/node_package/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/basho/node_package/downloads","issues_url":"https://api.github.com/repos/basho/node_package/issues{/number}","pulls_url":"https://api.github.com/repos/basho/node_package/pulls{/number}","milestones_url":"https://api.github.com/repos/basho/node_package/milestones{/number}","notifications_url":"https://api.github.com/repos/basho/node_package/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/basho/node_package/labels{/name}","releases_url":"https://api.github.com/repos/basho/node_package/releases{/id}","deployments_url":"https://api.github.com/repos/basho/node_package/deployments","created_at":"2011-04-10T21:52:23Z","updated_at":"2016-03-01T03:26:46Z","pushed_at":"2016-03-19T18:18:54Z","git_url":"git://github.com/basho/node_package.git","ssh_url":"git@github.com:basho/node_package.git","clone_url":"https://github.com/basho/node_package.git","svn_url":"https://github.com/basho/node_package","homepage":"","size":401,"stargazers_count":70,"watchers_count":70,"language":"Shell","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":39,"mirror_url":null,"open_issues_count":40,"forks":39,"open_issues":40,"watchers":70,"default_branch":"develop"}},"base":{"label":"basho:develop","ref":"develop","sha":"ed39189ebccd1d4e178e00ae88c87c2e261f6a3b","user":{"login":"basho","id":176293,"avatar_url":"https://avatars.githubusercontent.com/u/176293?v=3","gravatar_id":"","url":"https://api.github.com/users/basho","html_url":"https://github.com/basho","followers_url":"https://api.github.com/users/basho/followers","following_url":"https://api.github.com/users/basho/following{/other_user}","gists_url":"https://api.github.com/users/basho/gists{/gist_id}","starred_url":"https://api.github.com/users/basho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/basho/subscriptions","organizations_url":"https://api.github.com/users/basho/orgs","repos_url":"https://api.github.com/users/basho/repos","events_url":"https://api.github.com/users/basho/events{/privacy}","received_events_url":"https://api.github.com/users/basho/received_events","type":"Organization","site_admin":false},"repo":{"id":1596440,"name":"node_package","full_name":"basho/node_package","owner":{"login":"basho","id":176293,"avatar_url":"https://avatars.githubusercontent.com/u/176293?v=3","gravatar_id":"","url":"https://api.github.com/users/basho","html_url":"https://github.com/basho","followers_url":"https://api.github.com/users/basho/followers","following_url":"https://api.github.com/users/basho/following{/other_user}","gists_url":"https://api.github.com/users/basho/gists{/gist_id}","starred_url":"https://api.github.com/users/basho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/basho/subscriptions","organizations_url":"https://api.github.com/users/basho/orgs","repos_url":"https://api.github.com/users/basho/repos","events_url":"https://api.github.com/users/basho/events{/privacy}","received_events_url":"https://api.github.com/users/basho/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/basho/node_package","description":"RPM/Debian/FreeBSD/SmartOS/Solaris/OSX packaging templates for Erlang Nodes","fork":false,"url":"https://api.github.com/repos/basho/node_package","forks_url":"https://api.github.com/repos/basho/node_package/forks","keys_url":"https://api.github.com/repos/basho/node_package/keys{/key_id}","collaborators_url":"https://api.github.com/repos/basho/node_package/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/basho/node_package/teams","hooks_url":"https://api.github.com/repos/basho/node_package/hooks","issue_events_url":"https://api.github.com/repos/basho/node_package/issues/events{/number}","events_url":"https://api.github.com/repos/basho/node_package/events","assignees_url":"https://api.github.com/repos/basho/node_package/assignees{/user}","branches_url":"https://api.github.com/repos/basho/node_package/branches{/branch}","tags_url":"https://api.github.com/repos/basho/node_package/tags","blobs_url":"https://api.github.com/repos/basho/node_package/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/basho/node_package/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/basho/node_package/git/refs{/sha}","trees_url":"https://api.github.com/repos/basho/node_package/git/trees{/sha}","statuses_url":"https://api.github.com/repos/basho/node_package/statuses/{sha}","languages_url":"https://api.github.com/repos/basho/node_package/languages","stargazers_url":"https://api.github.com/repos/basho/node_package/stargazers","contributors_url":"https://api.github.com/repos/basho/node_package/contributors","subscribers_url":"https://api.github.com/repos/basho/node_package/subscribers","subscription_url":"https://api.github.com/repos/basho/node_package/subscription","commits_url":"https://api.github.com/repos/basho/node_package/commits{/sha}","git_commits_url":"https://api.github.com/repos/basho/node_package/git/commits{/sha}","comments_url":"https://api.github.com/repos/basho/node_package/comments{/number}","issue_comment_url":"https://api.github.com/repos/basho/node_package/issues/comments{/number}","contents_url":"https://api.github.com/repos/basho/node_package/contents/{+path}","compare_url":"https://api.github.com/repos/basho/node_package/compare/{base}...{head}","merges_url":"https://api.github.com/repos/basho/node_package/merges","archive_url":"https://api.github.com/repos/basho/node_package/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/basho/node_package/downloads","issues_url":"https://api.github.com/repos/basho/node_package/issues{/number}","pulls_url":"https://api.github.com/repos/basho/node_package/pulls{/number}","milestones_url":"https://api.github.com/repos/basho/node_package/milestones{/number}","notifications_url":"https://api.github.com/repos/basho/node_package/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/basho/node_package/labels{/name}","releases_url":"https://api.github.com/repos/basho/node_package/releases{/id}","deployments_url":"https://api.github.com/repos/basho/node_package/deployments","created_at":"2011-04-10T21:52:23Z","updated_at":"2016-03-01T03:26:46Z","pushed_at":"2016-03-19T18:18:54Z","git_url":"git://github.com/basho/node_package.git","ssh_url":"git@github.com:basho/node_package.git","clone_url":"https://github.com/basho/node_package.git","svn_url":"https://github.com/basho/node_package","homepage":"","size":401,"stargazers_count":70,"watchers_count":70,"language":"Shell","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":39,"mirror_url":null,"open_issues_count":40,"forks":39,"open_issues":40,"watchers":70,"default_branch":"develop"}},"_links":{"self":{"href":"https://api.github.com/repos/basho/node_package/pulls/200"},"html":{"href":"https://github.com/basho/node_package/pull/200"},"issue":{"href":"https://api.github.com/repos/basho/node_package/issues/200"},"comments":{"href":"https://api.github.com/repos/basho/node_package/issues/200/comments"},"review_comments":{"href":"https://api.github.com/repos/basho/node_package/pulls/200/comments"},"review_comment":{"href":"https://api.github.com/repos/basho/node_package/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/basho/node_package/pulls/200/commits"},"statuses":{"href":"https://api.github.com/repos/basho/node_package/statuses/1bc15c3e42f256ef1b258560690a90d9f6438013"}}}}