From 5c575e73c7e3d9efd84a86740d7c09b0316089ff Mon Sep 17 00:00:00 2001
From: pvogt09 <50047961+pvogt09@users.noreply.github.com>
Date: Tue, 30 Apr 2019 22:41:12 +0200
Subject: [PATCH 01/13] Adds world readable attribute to files created by
 Pi-hole to circumvent #2724

Signed-off-by: pvogt09 <50047961+pvogt09@users.noreply.github.com>
---
 advanced/Scripts/list.sh           |  5 ++++-
 advanced/Scripts/piholeCheckout.sh |  3 +++
 advanced/Scripts/piholeLogFlush.sh |  4 +++-
 advanced/Scripts/updatecheck.sh    |  3 +++
 advanced/Scripts/webpage.sh        |  3 +++
 automated install/basic-install.sh | 35 +++++++++++++++++++++++++-----
 automated install/uninstall.sh     |  2 +-
 gravity.sh                         |  8 ++++++-
 pihole                             |  4 ++++
 9 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/advanced/Scripts/list.sh b/advanced/Scripts/list.sh
index c1d95aae..e0455e0c 100755
--- a/advanced/Scripts/list.sh
+++ b/advanced/Scripts/list.sh
@@ -92,11 +92,13 @@ PoplistFile() {
     # Check whitelist file exists, and if not, create it
     if [[ ! -f "${whitelist}" ]]; then
         touch "${whitelist}"
+        chmod a+r "${whitelist}"
     fi
 
     # Check blacklist file exists, and if not, create it
     if [[ ! -f "${blacklist}" ]]; then
         touch "${blacklist}"
+        chmod a+r "${blacklist}"
     fi
 
     for dom in "${domList[@]}"; do
@@ -239,9 +241,10 @@ Displaylist() {
 NukeList() {
     if [[ -f "${listMain}" ]]; then
         # Back up original list
-        cp "${listMain}" "${listMain}.bck~"
+        cp -p "${listMain}" "${listMain}.bck~"
         # Empty out file
         echo "" > "${listMain}"
+        chmod a+r "${listMain}"
     fi
 }
 
diff --git a/advanced/Scripts/piholeCheckout.sh b/advanced/Scripts/piholeCheckout.sh
index 1bfe5e21..a982289f 100644
--- a/advanced/Scripts/piholeCheckout.sh
+++ b/advanced/Scripts/piholeCheckout.sh
@@ -90,6 +90,7 @@ checkout() {
         local path
         path="development/${binary}"
         echo "development" > /etc/pihole/ftlbranch
+        chmod a+r /etc/pihole/ftlbranch
     elif [[ "${1}" == "master" ]] ; then
         # Shortcut to check out master branches
         echo -e "  ${INFO} Shortcut \"master\" detected - checking out master branches..."
@@ -104,6 +105,7 @@ checkout() {
         local path
         path="master/${binary}"
         echo "master" > /etc/pihole/ftlbranch
+        chmod a+r /etc/pihole/ftlbranch
     elif [[ "${1}" == "core" ]] ; then
         str="Fetching branches from ${piholeGitUrl}"
         echo -ne "  ${INFO} $str"
@@ -166,6 +168,7 @@ checkout() {
         if check_download_exists "$path"; then
             echo "  ${TICK} Branch ${2} exists"
             echo "${2}" > /etc/pihole/ftlbranch
+            chmod a+r /etc/pihole/ftlbranch
             FTLinstall "${binary}"
             restart_service pihole-FTL
             enable_service pihole-FTL
diff --git a/advanced/Scripts/piholeLogFlush.sh b/advanced/Scripts/piholeLogFlush.sh
index 561fbce7..1e4b7abe 100755
--- a/advanced/Scripts/piholeLogFlush.sh
+++ b/advanced/Scripts/piholeLogFlush.sh
@@ -39,8 +39,9 @@ if [[ "$@" == *"once"* ]]; then
         # Note that moving the file is not an option, as
         # dnsmasq would happily continue writing into the
         # moved file (it will have the same file handler)
-        cp /var/log/pihole.log /var/log/pihole.log.1
+        cp -p /var/log/pihole.log /var/log/pihole.log.1
         echo " " > /var/log/pihole.log
+        chmod a+r /var/log/pihole.log
     fi
 else
     # Manual flushing
@@ -53,6 +54,7 @@ else
         echo " " > /var/log/pihole.log
         if [ -f /var/log/pihole.log.1 ]; then
             echo " " > /var/log/pihole.log.1
+            chmod a+r /var/log/pihole.log.1
         fi
     fi
     # Delete most recent 24 hours from FTL's database, leave even older data intact (don't wipe out all history)
diff --git a/advanced/Scripts/updatecheck.sh b/advanced/Scripts/updatecheck.sh
index 257c1929..55fce328 100755
--- a/advanced/Scripts/updatecheck.sh
+++ b/advanced/Scripts/updatecheck.sh
@@ -51,6 +51,7 @@ if [[ "$2" == "remote" ]]; then
 
     GITHUB_CORE_VERSION="$(json_extract tag_name "$(curl -s 'https://api.github.com/repos/pi-hole/pi-hole/releases/latest' 2> /dev/null)")"
     echo -n "${GITHUB_CORE_VERSION}" > "${GITHUB_VERSION_FILE}"
+    chmod a+r "${GITHUB_VERSION_FILE}"
 
     if [[ "${INSTALL_WEB_INTERFACE}" == true ]]; then
         GITHUB_WEB_VERSION="$(json_extract tag_name "$(curl -s 'https://api.github.com/repos/pi-hole/AdminLTE/releases/latest' 2> /dev/null)")"
@@ -66,6 +67,7 @@ else
 
     CORE_BRANCH="$(get_local_branch /etc/.pihole)"
     echo -n "${CORE_BRANCH}" > "${LOCAL_BRANCH_FILE}"
+    chmod a+r "${LOCAL_BRANCH_FILE}"
 
     if [[ "${INSTALL_WEB_INTERFACE}" == true ]]; then
         WEB_BRANCH="$(get_local_branch /var/www/html/admin)"
@@ -79,6 +81,7 @@ else
 
     CORE_VERSION="$(get_local_version /etc/.pihole)"
     echo -n "${CORE_VERSION}" > "${LOCAL_VERSION_FILE}"
+    chmod a+r "${LOCAL_VERSION_FILE}"
 
     if [[ "${INSTALL_WEB_INTERFACE}" == true ]]; then
         WEB_VERSION="$(get_local_version /var/www/html/admin)"
diff --git a/advanced/Scripts/webpage.sh b/advanced/Scripts/webpage.sh
index c6852896..eba539a6 100755
--- a/advanced/Scripts/webpage.sh
+++ b/advanced/Scripts/webpage.sh
@@ -322,6 +322,7 @@ dhcp-option=option:router,${DHCP_ROUTER}
 dhcp-leasefile=/etc/pihole/dhcp.leases
 #quiet-dhcp
 " > "${dhcpconfig}"
+    chmod a+r "${dhcpconfig}"
 
     if [[ "${PIHOLE_DOMAIN}" != "none" ]]; then
         echo "domain=${PIHOLE_DOMAIN}" >> "${dhcpconfig}"
@@ -541,11 +542,13 @@ addAudit()
     do
         echo "${var}" >> /etc/pihole/auditlog.list
     done
+    chmod a+r /etc/pihole/auditlog.list
 }
 
 clearAudit()
 {
     echo -n "" > /etc/pihole/auditlog.list
+    chmod a+r /etc/pihole/auditlog.list
 }
 
 SetPrivacyLevel() {
diff --git a/automated install/basic-install.sh b/automated install/basic-install.sh
index 94377647..2d85d854 100755
--- a/automated install/basic-install.sh	
+++ b/automated install/basic-install.sh	
@@ -194,7 +194,7 @@ if is_command apt-get ; then
             exit # exit the installer
         else
             printf "  %b Enabling universe package repository for Ubuntu Bionic\\n" "${INFO}"
-            cp ${APT_SOURCES} ${APT_SOURCES}.backup # Backup current repo list
+            cp -p ${APT_SOURCES} ${APT_SOURCES}.backup # Backup current repo list
             printf "  %b Backed up current configuration to %s\\n" "${TICK}" "${APT_SOURCES}.backup"
             add-apt-repository universe
             printf "  %b Enabled %s\\n" "${TICK}" "'universe' repository"
@@ -847,7 +847,7 @@ setIFCFG() {
         # Put the IP in variables without the CIDR notation
         printf -v CIDR "%s" "${IPV4_ADDRESS##*/}"
         # Backup existing interface configuration:
-        cp "${IFCFG_FILE}" "${IFCFG_FILE}".pihole.orig
+        cp -p "${IFCFG_FILE}" "${IFCFG_FILE}".pihole.orig
         # Build Interface configuration file using the GLOBAL variables we have
         {
         echo "# Configured via Pi-hole installer"
@@ -1241,7 +1241,8 @@ version_check_dnsmasq() {
             printf "%b  %b Backing up dnsmasq.conf to dnsmasq.conf.orig...\\n" "${OVER}"  "${TICK}"
             printf "  %b Restoring default dnsmasq.conf..." "${INFO}"
             # and replace it with the default
-            cp ${dnsmasq_original_config} ${dnsmasq_conf}
+            cp -p ${dnsmasq_original_config} ${dnsmasq_conf}
+            chmod a+r ${dnsmasq_conf}
             printf "%b  %b Restoring default dnsmasq.conf...\\n" "${OVER}"  "${TICK}"
         # Otherwise,
         else
@@ -1252,7 +1253,7 @@ version_check_dnsmasq() {
         # If a file cannot be found,
         printf "  %b No dnsmasq.conf found... restoring default dnsmasq.conf..." "${INFO}"
         # restore the default one
-        cp ${dnsmasq_original_config} ${dnsmasq_conf}
+        cp -p ${dnsmasq_original_config} ${dnsmasq_conf}
         printf "%b  %b No dnsmasq.conf found... restoring default dnsmasq.conf...\\n" "${OVER}"  "${TICK}"
     fi
 
@@ -1260,9 +1261,11 @@ version_check_dnsmasq() {
     # Check to see if dnsmasq directory exists (it may not due to being a fresh install and dnsmasq no longer being a dependency)
     if [[ ! -d "/etc/dnsmasq.d"  ]];then
         mkdir "/etc/dnsmasq.d"
+        chmod 755 "/etc/dnsmasq.d"
     fi
     # Copy the new Pi-hole DNS config file into the dnsmasq.d directory
     cp ${dnsmasq_pihole_01_snippet} ${dnsmasq_pihole_01_location}
+    chmod a+r ${dnsmasq_pihole_01_location}
     printf "%b  %b Copying 01-pihole.conf to /etc/dnsmasq.d/01-pihole.conf\\n" "${OVER}"  "${TICK}"
     # Replace our placeholder values with the GLOBAL DNS variables that we populated earlier
     # First, swap in the interface to listen on
@@ -1382,6 +1385,7 @@ installConfigs() {
             mkdir /etc/lighttpd
             # and set the owners
             chown "${USER}":root /etc/lighttpd
+            chmod 755 /etc/lighttpd
         # Otherwise, if the config file already exists
         elif [[ -f "/etc/lighttpd/lighttpd.conf" ]]; then
             # back up the original
@@ -1389,8 +1393,10 @@ installConfigs() {
         fi
         # and copy in the config file Pi-hole needs
         cp ${PI_HOLE_LOCAL_REPO}/advanced/${LIGHTTPD_CFG} /etc/lighttpd/lighttpd.conf
+        chmod a+r /etc/lighttpd/lighttpd.conf
         # Make sure the external.conf file exists, as lighttpd v1.4.50 crashes without it
         touch /etc/lighttpd/external.conf
+        chmod a+r /etc/lighttpd/external.conf
         # if there is a custom block page in the html/pihole directory, replace 404 handler in lighttpd config
         if [[ -f "${PI_HOLE_BLOCKPAGE_DIR}/custom.php" ]]; then
             sed -i 's/^\(server\.error-handler-404\s*=\s*\).*$/\1"pihole\/custom\.php"/' /etc/lighttpd/lighttpd.conf
@@ -1422,15 +1428,26 @@ install_manpage() {
     if [[ ! -d "/usr/local/share/man/man8" ]]; then
         # if not present, create man8 directory
         mkdir /usr/local/share/man/man8
+        chown root:staff /usr/local/share/man/man8
+        chmod a+r /usr/local/share/man/man8
+        chmod a+x /usr/local/share/man/man8
+        chmod g+s /usr/local/share/man/man8
     fi
     if [[ ! -d "/usr/local/share/man/man5" ]]; then
-        # if not present, create man8 directory
+        # if not present, create man5 directory
         mkdir /usr/local/share/man/man5
+        chown root:staff /usr/local/share/man/man5
+        chmod a+r /usr/local/share/man/man5
+        chmod a+x /usr/local/share/man/man5
+        chmod g+s /usr/local/share/man/man5
     fi
     # Testing complete, copy the files & update the man db
     cp ${PI_HOLE_LOCAL_REPO}/manpages/pihole.8 /usr/local/share/man/man8/pihole.8
+    chmod a+r /usr/local/share/man/man8/pihole.8
     cp ${PI_HOLE_LOCAL_REPO}/manpages/pihole-FTL.8 /usr/local/share/man/man8/pihole-FTL.8
+    chmod a+r /usr/local/share/man/man8/pihole-FTL.8
     cp ${PI_HOLE_LOCAL_REPO}/manpages/pihole-FTL.conf.5 /usr/local/share/man/man5/pihole-FTL.conf.5
+    chmod a+r /usr/local/share/man/man5/pihole-FTL.conf.5
     if mandb -q &>/dev/null; then
         # Updated successfully
         printf "%b  %b man pages installed and database updated\\n" "${OVER}" "${TICK}"
@@ -1711,6 +1728,9 @@ installCron() {
     printf "\\n  %b %s..." "${INFO}" "${str}"
     # Copy the cron file over from the local repo
     cp ${PI_HOLE_LOCAL_REPO}/advanced/Templates/pihole.cron /etc/cron.d/pihole
+    # File must not be world or group writeable and must be owned by root
+    chmod 644 /etc/cron.d/pihole
+    chown root:root /etc/cron.d/pihole
     # Randomize gravity update time
     sed -i "s/59 1 /$((1 + RANDOM % 58)) $((3 + RANDOM % 2))/" /etc/cron.d/pihole
     # Randomize update checker time
@@ -1818,6 +1838,7 @@ finalExports() {
     echo "INSTALL_WEB_INTERFACE=${INSTALL_WEB_INTERFACE}"
     echo "LIGHTTPD_ENABLED=${LIGHTTPD_ENABLED}"
     }>> "${setupVars}"
+    chmod 744 "${setupVars}"
 
     # Set the privacy level
     sed -i '/PRIVACYLEVEL/d' "${PI_HOLE_CONFIG_DIR}/pihole-FTL.conf"
@@ -1841,6 +1862,7 @@ installLogrotate() {
     printf "\\n  %b %s..." "${INFO}" "${str}"
     # Copy the file over from the local repo
     cp ${PI_HOLE_LOCAL_REPO}/advanced/Templates/logrotate /etc/pihole/logrotate
+    chmod a+r /etc/pihole/logrotate
     # Different operating systems have different user / group
     # settings for logrotate that makes it impossible to create
     # a static logrotate file that will work with e.g.
@@ -2431,6 +2453,7 @@ copy_to_install_log() {
     # Copy the contents of file descriptor 3 into the install log
     # Since we use color codes such as '\e[1;33m', they should be removed
     sed 's/\[[0-9;]\{1,5\}m//g' < /proc/$$/fd/3 > "${installLogLoc}"
+    chmod a+r "${installLogLoc}"
 }
 
 main() {
@@ -2516,6 +2539,8 @@ main() {
         welcomeDialogs
         # Create directory for Pi-hole storage
         mkdir -p /etc/pihole/
+        chmod a+r /ect/pihole/
+        chmod a+x /etc/pihole/
         # Determine available interfaces
         get_available_interfaces
         # Find interfaces and let the user choose one
diff --git a/automated install/uninstall.sh b/automated install/uninstall.sh
index d0a6dcf0..732fc246 100755
--- a/automated install/uninstall.sh	
+++ b/automated install/uninstall.sh	
@@ -153,7 +153,7 @@ removeNoPurge() {
 
     # Restore Resolved
     if [[ -e /etc/systemd/resolved.conf.orig ]]; then
-        ${SUDO} cp /etc/systemd/resolved.conf.orig /etc/systemd/resolved.conf
+        ${SUDO} cp -p /etc/systemd/resolved.conf.orig /etc/systemd/resolved.conf
         systemctl reload-or-restart systemd-resolved
     fi
 
diff --git a/gravity.sh b/gravity.sh
index 015764ac..6ae0e337 100755
--- a/gravity.sh
+++ b/gravity.sh
@@ -485,6 +485,7 @@ gravity_SortAndFilterConsolidatedList() {
   fi
 
   sort -u "${piholeDir}/${parsedMatter}" > "${piholeDir}/${preEventHorizon}"
+  chmod a+r "${piholeDir}/${preEventHorizon}"
 
   if [[ "${haveSourceUrls}" == true ]]; then
     echo -e "${OVER}  ${TICK} ${str}"
@@ -509,6 +510,7 @@ gravity_Whitelist() {
 
   # Print everything from preEventHorizon into whitelistMatter EXCEPT domains in $whitelistFile
   comm -23 "${piholeDir}/${preEventHorizon}" <(sort "${whitelistFile}") > "${piholeDir}/${whitelistMatter}"
+  chmod a+r "${piholeDir}/${whitelistMatter}"
 
   echo -e "${OVER}  ${INFO} ${str}"
 }
@@ -561,6 +563,7 @@ gravity_ParseLocalDomains() {
 
   # Empty $localList if it already exists, otherwise, create it
   : > "${localList}"
+  chmod a+r "${localList}"
 
   gravity_ParseDomainsIntoHosts "${localList}.tmp" "${localList}"
 
@@ -581,8 +584,9 @@ gravity_ParseBlacklistDomains() {
     mv "${piholeDir}/${whitelistMatter}" "${piholeDir}/${accretionDisc}"
   else
     # There was no whitelist file, so use preEventHorizon instead of whitelistMatter.
-    cp "${piholeDir}/${preEventHorizon}" "${piholeDir}/${accretionDisc}"
+    cp -p "${piholeDir}/${preEventHorizon}" "${piholeDir}/${accretionDisc}"
   fi
+  chmod a+r "${piholeDir}/${accretionDisc}"
 
   # Move the file over as /etc/pihole/gravity.list so dnsmasq can use it
   output=$( { mv "${piholeDir}/${accretionDisc}" "${adList}"; } 2>&1 )
@@ -592,6 +596,7 @@ gravity_ParseBlacklistDomains() {
     echo -e "\\n  ${CROSS} Unable to move ${accretionDisc} from ${piholeDir}\\n  ${output}"
     gravity_Cleanup "error"
   fi
+  chmod a+r "${adList}"
 }
 
 # Create user-added blacklist entries
@@ -602,6 +607,7 @@ gravity_ParseUserDomains() {
   # Copy the file over as /etc/pihole/black.list so dnsmasq can use it
   cp "${blacklistFile}" "${blackList}" 2> /dev/null || \
     echo -e "\\n  ${CROSS} Unable to move ${blacklistFile##*/} to ${piholeDir}"
+  chmod a+r "${blackList}"
 }
 
 # Trap Ctrl-C
diff --git a/pihole b/pihole
index 84a5623f..59a99af1 100755
--- a/pihole
+++ b/pihole
@@ -151,10 +151,12 @@ Time:
     if [[ -e "${gravitylist}" ]]; then
       mv "${gravitylist}" "${gravitylist}.bck"
       echo "" > "${gravitylist}"
+	  chmod a+r "${gravitylist}"
     fi
     if [[ -e "${blacklist}" ]]; then
       mv "${blacklist}" "${blacklist}.bck"
       echo "" > "${blacklist}"
+	  chmod a+r "${blacklist}"
     fi
     if [[ $# > 1 ]]; then
       local error=false
@@ -206,9 +208,11 @@ Time:
 
     if [[ -e "${gravitylist}.bck" ]]; then
       mv "${gravitylist}.bck" "${gravitylist}"
+	  chmod a+r "${gravitylist}"
     fi
     if [[ -e "${blacklist}.bck" ]]; then
       mv "${blacklist}.bck" "${blacklist}"
+	  chmod a+r "${blacklist}"
     fi
     sed -i "/BLOCKING_ENABLED=/d" "${setupVars}"
     echo "BLOCKING_ENABLED=true" >> "${setupVars}"

From 8a92fb24c4d4e3caff4286ea8698becdfe986a58 Mon Sep 17 00:00:00 2001
From: pvogt09 <50047961+pvogt09@users.noreply.github.com>
Date: Wed, 1 May 2019 11:20:26 +0200
Subject: [PATCH 02/13] Incorporates changes requested by @Mcat12

Signed-off-by: pvogt09 <50047961+pvogt09@users.noreply.github.com>
---
 advanced/Scripts/list.sh           |  6 +++---
 advanced/Scripts/piholeCheckout.sh |  6 +++---
 advanced/Scripts/piholeLogFlush.sh |  4 ++--
 advanced/Scripts/updatecheck.sh    |  6 +++---
 advanced/Scripts/webpage.sh        |  6 +++---
 automated install/basic-install.sh | 33 ++++++++++++------------------
 gravity.sh                         | 12 +++++------
 pihole                             |  8 ++++----
 8 files changed, 37 insertions(+), 44 deletions(-)

diff --git a/advanced/Scripts/list.sh b/advanced/Scripts/list.sh
index e0455e0c..b4fffbaf 100755
--- a/advanced/Scripts/list.sh
+++ b/advanced/Scripts/list.sh
@@ -92,13 +92,13 @@ PoplistFile() {
     # Check whitelist file exists, and if not, create it
     if [[ ! -f "${whitelist}" ]]; then
         touch "${whitelist}"
-        chmod a+r "${whitelist}"
+        chmod 644 "${whitelist}"
     fi
 
     # Check blacklist file exists, and if not, create it
     if [[ ! -f "${blacklist}" ]]; then
         touch "${blacklist}"
-        chmod a+r "${blacklist}"
+        chmod 644 "${blacklist}"
     fi
 
     for dom in "${domList[@]}"; do
@@ -244,7 +244,7 @@ NukeList() {
         cp -p "${listMain}" "${listMain}.bck~"
         # Empty out file
         echo "" > "${listMain}"
-        chmod a+r "${listMain}"
+        chmod 644 "${listMain}"
     fi
 }
 
diff --git a/advanced/Scripts/piholeCheckout.sh b/advanced/Scripts/piholeCheckout.sh
index a982289f..13fa3402 100644
--- a/advanced/Scripts/piholeCheckout.sh
+++ b/advanced/Scripts/piholeCheckout.sh
@@ -90,7 +90,7 @@ checkout() {
         local path
         path="development/${binary}"
         echo "development" > /etc/pihole/ftlbranch
-        chmod a+r /etc/pihole/ftlbranch
+        chmod 644 /etc/pihole/ftlbranch
     elif [[ "${1}" == "master" ]] ; then
         # Shortcut to check out master branches
         echo -e "  ${INFO} Shortcut \"master\" detected - checking out master branches..."
@@ -105,7 +105,7 @@ checkout() {
         local path
         path="master/${binary}"
         echo "master" > /etc/pihole/ftlbranch
-        chmod a+r /etc/pihole/ftlbranch
+        chmod 644 /etc/pihole/ftlbranch
     elif [[ "${1}" == "core" ]] ; then
         str="Fetching branches from ${piholeGitUrl}"
         echo -ne "  ${INFO} $str"
@@ -168,7 +168,7 @@ checkout() {
         if check_download_exists "$path"; then
             echo "  ${TICK} Branch ${2} exists"
             echo "${2}" > /etc/pihole/ftlbranch
-            chmod a+r /etc/pihole/ftlbranch
+            chmod 644 /etc/pihole/ftlbranch
             FTLinstall "${binary}"
             restart_service pihole-FTL
             enable_service pihole-FTL
diff --git a/advanced/Scripts/piholeLogFlush.sh b/advanced/Scripts/piholeLogFlush.sh
index 1e4b7abe..51e94d7c 100755
--- a/advanced/Scripts/piholeLogFlush.sh
+++ b/advanced/Scripts/piholeLogFlush.sh
@@ -41,7 +41,7 @@ if [[ "$@" == *"once"* ]]; then
         # moved file (it will have the same file handler)
         cp -p /var/log/pihole.log /var/log/pihole.log.1
         echo " " > /var/log/pihole.log
-        chmod a+r /var/log/pihole.log
+        chmod 644 /var/log/pihole.log
     fi
 else
     # Manual flushing
@@ -54,7 +54,7 @@ else
         echo " " > /var/log/pihole.log
         if [ -f /var/log/pihole.log.1 ]; then
             echo " " > /var/log/pihole.log.1
-            chmod a+r /var/log/pihole.log.1
+            chmod 644 /var/log/pihole.log.1
         fi
     fi
     # Delete most recent 24 hours from FTL's database, leave even older data intact (don't wipe out all history)
diff --git a/advanced/Scripts/updatecheck.sh b/advanced/Scripts/updatecheck.sh
index 55fce328..972ab585 100755
--- a/advanced/Scripts/updatecheck.sh
+++ b/advanced/Scripts/updatecheck.sh
@@ -51,7 +51,7 @@ if [[ "$2" == "remote" ]]; then
 
     GITHUB_CORE_VERSION="$(json_extract tag_name "$(curl -s 'https://api.github.com/repos/pi-hole/pi-hole/releases/latest' 2> /dev/null)")"
     echo -n "${GITHUB_CORE_VERSION}" > "${GITHUB_VERSION_FILE}"
-    chmod a+r "${GITHUB_VERSION_FILE}"
+    chmod 644 "${GITHUB_VERSION_FILE}"
 
     if [[ "${INSTALL_WEB_INTERFACE}" == true ]]; then
         GITHUB_WEB_VERSION="$(json_extract tag_name "$(curl -s 'https://api.github.com/repos/pi-hole/AdminLTE/releases/latest' 2> /dev/null)")"
@@ -67,7 +67,7 @@ else
 
     CORE_BRANCH="$(get_local_branch /etc/.pihole)"
     echo -n "${CORE_BRANCH}" > "${LOCAL_BRANCH_FILE}"
-    chmod a+r "${LOCAL_BRANCH_FILE}"
+    chmod 644 "${LOCAL_BRANCH_FILE}"
 
     if [[ "${INSTALL_WEB_INTERFACE}" == true ]]; then
         WEB_BRANCH="$(get_local_branch /var/www/html/admin)"
@@ -81,7 +81,7 @@ else
 
     CORE_VERSION="$(get_local_version /etc/.pihole)"
     echo -n "${CORE_VERSION}" > "${LOCAL_VERSION_FILE}"
-    chmod a+r "${LOCAL_VERSION_FILE}"
+    chmod 644 "${LOCAL_VERSION_FILE}"
 
     if [[ "${INSTALL_WEB_INTERFACE}" == true ]]; then
         WEB_VERSION="$(get_local_version /var/www/html/admin)"
diff --git a/advanced/Scripts/webpage.sh b/advanced/Scripts/webpage.sh
index eba539a6..467eebd6 100755
--- a/advanced/Scripts/webpage.sh
+++ b/advanced/Scripts/webpage.sh
@@ -322,7 +322,7 @@ dhcp-option=option:router,${DHCP_ROUTER}
 dhcp-leasefile=/etc/pihole/dhcp.leases
 #quiet-dhcp
 " > "${dhcpconfig}"
-    chmod a+r "${dhcpconfig}"
+    chmod 644 "${dhcpconfig}"
 
     if [[ "${PIHOLE_DOMAIN}" != "none" ]]; then
         echo "domain=${PIHOLE_DOMAIN}" >> "${dhcpconfig}"
@@ -542,13 +542,13 @@ addAudit()
     do
         echo "${var}" >> /etc/pihole/auditlog.list
     done
-    chmod a+r /etc/pihole/auditlog.list
+    chmod 644 /etc/pihole/auditlog.list
 }
 
 clearAudit()
 {
     echo -n "" > /etc/pihole/auditlog.list
-    chmod a+r /etc/pihole/auditlog.list
+    chmod 644 /etc/pihole/auditlog.list
 }
 
 SetPrivacyLevel() {
diff --git a/automated install/basic-install.sh b/automated install/basic-install.sh
index 2d85d854..c1f69efb 100755
--- a/automated install/basic-install.sh	
+++ b/automated install/basic-install.sh	
@@ -1242,7 +1242,7 @@ version_check_dnsmasq() {
             printf "  %b Restoring default dnsmasq.conf..." "${INFO}"
             # and replace it with the default
             cp -p ${dnsmasq_original_config} ${dnsmasq_conf}
-            chmod a+r ${dnsmasq_conf}
+            chmod 644 ${dnsmasq_conf}
             printf "%b  %b Restoring default dnsmasq.conf...\\n" "${OVER}"  "${TICK}"
         # Otherwise,
         else
@@ -1265,7 +1265,7 @@ version_check_dnsmasq() {
     fi
     # Copy the new Pi-hole DNS config file into the dnsmasq.d directory
     cp ${dnsmasq_pihole_01_snippet} ${dnsmasq_pihole_01_location}
-    chmod a+r ${dnsmasq_pihole_01_location}
+    chmod 644 ${dnsmasq_pihole_01_location}
     printf "%b  %b Copying 01-pihole.conf to /etc/dnsmasq.d/01-pihole.conf\\n" "${OVER}"  "${TICK}"
     # Replace our placeholder values with the GLOBAL DNS variables that we populated earlier
     # First, swap in the interface to listen on
@@ -1393,10 +1393,10 @@ installConfigs() {
         fi
         # and copy in the config file Pi-hole needs
         cp ${PI_HOLE_LOCAL_REPO}/advanced/${LIGHTTPD_CFG} /etc/lighttpd/lighttpd.conf
-        chmod a+r /etc/lighttpd/lighttpd.conf
+        chmod 644 /etc/lighttpd/lighttpd.conf
         # Make sure the external.conf file exists, as lighttpd v1.4.50 crashes without it
         touch /etc/lighttpd/external.conf
-        chmod a+r /etc/lighttpd/external.conf
+        chmod 644 /etc/lighttpd/external.conf
         # if there is a custom block page in the html/pihole directory, replace 404 handler in lighttpd config
         if [[ -f "${PI_HOLE_BLOCKPAGE_DIR}/custom.php" ]]; then
             sed -i 's/^\(server\.error-handler-404\s*=\s*\).*$/\1"pihole\/custom\.php"/' /etc/lighttpd/lighttpd.conf
@@ -1428,26 +1428,20 @@ install_manpage() {
     if [[ ! -d "/usr/local/share/man/man8" ]]; then
         # if not present, create man8 directory
         mkdir /usr/local/share/man/man8
-        chown root:staff /usr/local/share/man/man8
-        chmod a+r /usr/local/share/man/man8
-        chmod a+x /usr/local/share/man/man8
-        chmod g+s /usr/local/share/man/man8
+        chmod 755 /usr/local/share/man/man8
     fi
     if [[ ! -d "/usr/local/share/man/man5" ]]; then
         # if not present, create man5 directory
         mkdir /usr/local/share/man/man5
-        chown root:staff /usr/local/share/man/man5
-        chmod a+r /usr/local/share/man/man5
-        chmod a+x /usr/local/share/man/man5
-        chmod g+s /usr/local/share/man/man5
+        chmod 755 /usr/local/share/man/man5
     fi
     # Testing complete, copy the files & update the man db
     cp ${PI_HOLE_LOCAL_REPO}/manpages/pihole.8 /usr/local/share/man/man8/pihole.8
-    chmod a+r /usr/local/share/man/man8/pihole.8
+    chmod 644 /usr/local/share/man/man8/pihole.8
     cp ${PI_HOLE_LOCAL_REPO}/manpages/pihole-FTL.8 /usr/local/share/man/man8/pihole-FTL.8
-    chmod a+r /usr/local/share/man/man8/pihole-FTL.8
+    chmod 644 /usr/local/share/man/man8/pihole-FTL.8
     cp ${PI_HOLE_LOCAL_REPO}/manpages/pihole-FTL.conf.5 /usr/local/share/man/man5/pihole-FTL.conf.5
-    chmod a+r /usr/local/share/man/man5/pihole-FTL.conf.5
+    chmod 644 /usr/local/share/man/man5/pihole-FTL.conf.5
     if mandb -q &>/dev/null; then
         # Updated successfully
         printf "%b  %b man pages installed and database updated\\n" "${OVER}" "${TICK}"
@@ -1838,7 +1832,7 @@ finalExports() {
     echo "INSTALL_WEB_INTERFACE=${INSTALL_WEB_INTERFACE}"
     echo "LIGHTTPD_ENABLED=${LIGHTTPD_ENABLED}"
     }>> "${setupVars}"
-    chmod 744 "${setupVars}"
+    chmod 644 "${setupVars}"
 
     # Set the privacy level
     sed -i '/PRIVACYLEVEL/d' "${PI_HOLE_CONFIG_DIR}/pihole-FTL.conf"
@@ -1862,7 +1856,7 @@ installLogrotate() {
     printf "\\n  %b %s..." "${INFO}" "${str}"
     # Copy the file over from the local repo
     cp ${PI_HOLE_LOCAL_REPO}/advanced/Templates/logrotate /etc/pihole/logrotate
-    chmod a+r /etc/pihole/logrotate
+    chmod 644 /etc/pihole/logrotate
     # Different operating systems have different user / group
     # settings for logrotate that makes it impossible to create
     # a static logrotate file that will work with e.g.
@@ -2453,7 +2447,7 @@ copy_to_install_log() {
     # Copy the contents of file descriptor 3 into the install log
     # Since we use color codes such as '\e[1;33m', they should be removed
     sed 's/\[[0-9;]\{1,5\}m//g' < /proc/$$/fd/3 > "${installLogLoc}"
-    chmod a+r "${installLogLoc}"
+    chmod 644 "${installLogLoc}"
 }
 
 main() {
@@ -2539,8 +2533,7 @@ main() {
         welcomeDialogs
         # Create directory for Pi-hole storage
         mkdir -p /etc/pihole/
-        chmod a+r /ect/pihole/
-        chmod a+x /etc/pihole/
+        chmod 755 /ect/pihole/
         # Determine available interfaces
         get_available_interfaces
         # Find interfaces and let the user choose one
diff --git a/gravity.sh b/gravity.sh
index 6ae0e337..a2f2c782 100755
--- a/gravity.sh
+++ b/gravity.sh
@@ -485,7 +485,7 @@ gravity_SortAndFilterConsolidatedList() {
   fi
 
   sort -u "${piholeDir}/${parsedMatter}" > "${piholeDir}/${preEventHorizon}"
-  chmod a+r "${piholeDir}/${preEventHorizon}"
+  chmod 644 "${piholeDir}/${preEventHorizon}"
 
   if [[ "${haveSourceUrls}" == true ]]; then
     echo -e "${OVER}  ${TICK} ${str}"
@@ -510,7 +510,7 @@ gravity_Whitelist() {
 
   # Print everything from preEventHorizon into whitelistMatter EXCEPT domains in $whitelistFile
   comm -23 "${piholeDir}/${preEventHorizon}" <(sort "${whitelistFile}") > "${piholeDir}/${whitelistMatter}"
-  chmod a+r "${piholeDir}/${whitelistMatter}"
+  chmod 644 "${piholeDir}/${whitelistMatter}"
 
   echo -e "${OVER}  ${INFO} ${str}"
 }
@@ -563,7 +563,7 @@ gravity_ParseLocalDomains() {
 
   # Empty $localList if it already exists, otherwise, create it
   : > "${localList}"
-  chmod a+r "${localList}"
+  chmod 644 "${localList}"
 
   gravity_ParseDomainsIntoHosts "${localList}.tmp" "${localList}"
 
@@ -586,7 +586,7 @@ gravity_ParseBlacklistDomains() {
     # There was no whitelist file, so use preEventHorizon instead of whitelistMatter.
     cp -p "${piholeDir}/${preEventHorizon}" "${piholeDir}/${accretionDisc}"
   fi
-  chmod a+r "${piholeDir}/${accretionDisc}"
+  chmod 644 "${piholeDir}/${accretionDisc}"
 
   # Move the file over as /etc/pihole/gravity.list so dnsmasq can use it
   output=$( { mv "${piholeDir}/${accretionDisc}" "${adList}"; } 2>&1 )
@@ -596,7 +596,7 @@ gravity_ParseBlacklistDomains() {
     echo -e "\\n  ${CROSS} Unable to move ${accretionDisc} from ${piholeDir}\\n  ${output}"
     gravity_Cleanup "error"
   fi
-  chmod a+r "${adList}"
+  chmod 644 "${adList}"
 }
 
 # Create user-added blacklist entries
@@ -607,7 +607,7 @@ gravity_ParseUserDomains() {
   # Copy the file over as /etc/pihole/black.list so dnsmasq can use it
   cp "${blacklistFile}" "${blackList}" 2> /dev/null || \
     echo -e "\\n  ${CROSS} Unable to move ${blacklistFile##*/} to ${piholeDir}"
-  chmod a+r "${blackList}"
+  chmod 644 "${blackList}"
 }
 
 # Trap Ctrl-C
diff --git a/pihole b/pihole
index 59a99af1..541434a0 100755
--- a/pihole
+++ b/pihole
@@ -151,12 +151,12 @@ Time:
     if [[ -e "${gravitylist}" ]]; then
       mv "${gravitylist}" "${gravitylist}.bck"
       echo "" > "${gravitylist}"
-	  chmod a+r "${gravitylist}"
+	  chmod 644 "${gravitylist}"
     fi
     if [[ -e "${blacklist}" ]]; then
       mv "${blacklist}" "${blacklist}.bck"
       echo "" > "${blacklist}"
-	  chmod a+r "${blacklist}"
+	  chmod 644 "${blacklist}"
     fi
     if [[ $# > 1 ]]; then
       local error=false
@@ -208,11 +208,11 @@ Time:
 
     if [[ -e "${gravitylist}.bck" ]]; then
       mv "${gravitylist}.bck" "${gravitylist}"
-	  chmod a+r "${gravitylist}"
+	  chmod 644 "${gravitylist}"
     fi
     if [[ -e "${blacklist}.bck" ]]; then
       mv "${blacklist}.bck" "${blacklist}"
-	  chmod a+r "${blacklist}"
+	  chmod 644 "${blacklist}"
     fi
     sed -i "/BLOCKING_ENABLED=/d" "${setupVars}"
     echo "BLOCKING_ENABLED=true" >> "${setupVars}"

From 2c3a27e9c7e03ac0464808ae0faf346568f135bc Mon Sep 17 00:00:00 2001
From: pvogt09 <50047961+pvogt09@users.noreply.github.com>
Date: Fri, 3 May 2019 12:27:56 +0200
Subject: [PATCH 03/13] Replaces cp chmod with install and add read permission
 to repository files after checkout and pull

Signed-off-by: pvogt09 <50047961+pvogt09@users.noreply.github.com>
---
 automated install/basic-install.sh | 56 +++++++++++++-----------------
 1 file changed, 24 insertions(+), 32 deletions(-)

diff --git a/automated install/basic-install.sh b/automated install/basic-install.sh
index c1f69efb..0d574f20 100755
--- a/automated install/basic-install.sh	
+++ b/automated install/basic-install.sh	
@@ -414,6 +414,8 @@ make_repo() {
     fi
     # Clone the repo and return the return code from this command
     git clone -q --depth 1 "${remoteRepo}" "${directory}" &> /dev/null || return $?
+    # Data in the repositories is public anyway so we can make it readable by everyone (+r to keep executable permission if already set by git)
+    chmod -R a+r "${directory}"
     # Show a colored message showing it's status
     printf "%b  %b %s\\n" "${OVER}" "${TICK}" "${str}"
     # Always return 0? Not sure this is correct
@@ -447,6 +449,8 @@ update_repo() {
     git pull --quiet &> /dev/null || return $?
     # Show a completion message
     printf "%b  %b %s\\n" "${OVER}" "${TICK}" "${str}"
+    # Data in the repositories is public anyway so we can make it readable by everyone (+r to keep executable permission if already set by git)
+    chmod -R a+r "${directory}"
     # Move back into the original directory
     cd "${curdir}" &> /dev/null || return 1
     return 0
@@ -494,6 +498,8 @@ resetRepo() {
     printf "  %b %s..." "${INFO}" "${str}"
     # Use git to remove the local changes
     git reset --hard &> /dev/null || return $?
+    # Data in the repositories is public anyway so we can make it readable by everyone (+r to keep executable permission if already set by git)
+    chmod -R a+r "${directory}"
     # And show the status
     printf "%b  %b %s\\n" "${OVER}" "${TICK}" "${str}"
     # Returning success anyway?
@@ -1241,8 +1247,7 @@ version_check_dnsmasq() {
             printf "%b  %b Backing up dnsmasq.conf to dnsmasq.conf.orig...\\n" "${OVER}"  "${TICK}"
             printf "  %b Restoring default dnsmasq.conf..." "${INFO}"
             # and replace it with the default
-            cp -p ${dnsmasq_original_config} ${dnsmasq_conf}
-            chmod 644 ${dnsmasq_conf}
+            install -D -m 644 -T ${dnsmasq_original_config} ${dnsmasq_conf}
             printf "%b  %b Restoring default dnsmasq.conf...\\n" "${OVER}"  "${TICK}"
         # Otherwise,
         else
@@ -1253,19 +1258,17 @@ version_check_dnsmasq() {
         # If a file cannot be found,
         printf "  %b No dnsmasq.conf found... restoring default dnsmasq.conf..." "${INFO}"
         # restore the default one
-        cp -p ${dnsmasq_original_config} ${dnsmasq_conf}
+        install -D -m 644 -T ${dnsmasq_original_config} ${dnsmasq_conf}
         printf "%b  %b No dnsmasq.conf found... restoring default dnsmasq.conf...\\n" "${OVER}"  "${TICK}"
     fi
 
     printf "  %b Copying 01-pihole.conf to /etc/dnsmasq.d/01-pihole.conf..." "${INFO}"
     # Check to see if dnsmasq directory exists (it may not due to being a fresh install and dnsmasq no longer being a dependency)
     if [[ ! -d "/etc/dnsmasq.d"  ]];then
-        mkdir "/etc/dnsmasq.d"
-        chmod 755 "/etc/dnsmasq.d"
+        install -d -m 755 "/etc/dnsmasq.d"
     fi
     # Copy the new Pi-hole DNS config file into the dnsmasq.d directory
-    cp ${dnsmasq_pihole_01_snippet} ${dnsmasq_pihole_01_location}
-    chmod 644 ${dnsmasq_pihole_01_location}
+    install -D -m 644 -T ${dnsmasq_pihole_01_snippet} ${dnsmasq_pihole_01_location}
     printf "%b  %b Copying 01-pihole.conf to /etc/dnsmasq.d/01-pihole.conf\\n" "${OVER}"  "${TICK}"
     # Replace our placeholder values with the GLOBAL DNS variables that we populated earlier
     # First, swap in the interface to listen on
@@ -1381,19 +1384,15 @@ installConfigs() {
     if [[ "${INSTALL_WEB_SERVER}" == true ]]; then
         # and if the Web server conf directory does not exist,
         if [[ ! -d "/etc/lighttpd" ]]; then
-            # make it
-            mkdir /etc/lighttpd
-            # and set the owners
-            chown "${USER}":root /etc/lighttpd
-            chmod 755 /etc/lighttpd
+            # make it and set the owners
+            install -d -m 755 -o "${USER}" -g root /etc/lighttpd
         # Otherwise, if the config file already exists
         elif [[ -f "/etc/lighttpd/lighttpd.conf" ]]; then
             # back up the original
             mv /etc/lighttpd/lighttpd.conf /etc/lighttpd/lighttpd.conf.orig
         fi
         # and copy in the config file Pi-hole needs
-        cp ${PI_HOLE_LOCAL_REPO}/advanced/${LIGHTTPD_CFG} /etc/lighttpd/lighttpd.conf
-        chmod 644 /etc/lighttpd/lighttpd.conf
+        install -D -m 644 -T ${PI_HOLE_LOCAL_REPO}/advanced/${LIGHTTPD_CFG} /etc/lighttpd/lighttpd.conf
         # Make sure the external.conf file exists, as lighttpd v1.4.50 crashes without it
         touch /etc/lighttpd/external.conf
         chmod 644 /etc/lighttpd/external.conf
@@ -1427,21 +1426,16 @@ install_manpage() {
     fi
     if [[ ! -d "/usr/local/share/man/man8" ]]; then
         # if not present, create man8 directory
-        mkdir /usr/local/share/man/man8
-        chmod 755 /usr/local/share/man/man8
+        install -d -m 755 /usr/local/share/man/man8
     fi
     if [[ ! -d "/usr/local/share/man/man5" ]]; then
         # if not present, create man5 directory
-        mkdir /usr/local/share/man/man5
-        chmod 755 /usr/local/share/man/man5
+        install -d -m 755 /usr/local/share/man/man5
     fi
     # Testing complete, copy the files & update the man db
-    cp ${PI_HOLE_LOCAL_REPO}/manpages/pihole.8 /usr/local/share/man/man8/pihole.8
-    chmod 644 /usr/local/share/man/man8/pihole.8
-    cp ${PI_HOLE_LOCAL_REPO}/manpages/pihole-FTL.8 /usr/local/share/man/man8/pihole-FTL.8
-    chmod 644 /usr/local/share/man/man8/pihole-FTL.8
-    cp ${PI_HOLE_LOCAL_REPO}/manpages/pihole-FTL.conf.5 /usr/local/share/man/man5/pihole-FTL.conf.5
-    chmod 644 /usr/local/share/man/man5/pihole-FTL.conf.5
+    install -D -m 644 -T ${PI_HOLE_LOCAL_REPO}/manpages/pihole.8 /usr/local/share/man/man8/pihole.8
+    install -D -m 644 -T ${PI_HOLE_LOCAL_REPO}/manpages/pihole-FTL.8 /usr/local/share/man/man8/pihole-FTL.8
+    install -D -m 644 -T ${PI_HOLE_LOCAL_REPO}/manpages/pihole-FTL.conf.5 /usr/local/share/man/man5/pihole-FTL.conf.5
     if mandb -q &>/dev/null; then
         # Updated successfully
         printf "%b  %b man pages installed and database updated\\n" "${OVER}" "${TICK}"
@@ -1671,7 +1665,7 @@ installPiholeWeb() {
     # Install the directory
     install -d -m 0755 ${PI_HOLE_BLOCKPAGE_DIR}
     # and the blockpage
-    install -D ${PI_HOLE_LOCAL_REPO}/advanced/{index,blockingpage}.* ${PI_HOLE_BLOCKPAGE_DIR}/
+    install -D -m 644 ${PI_HOLE_LOCAL_REPO}/advanced/{index,blockingpage}.* ${PI_HOLE_BLOCKPAGE_DIR}/
 
     # Remove superseded file
     if [[ -e "${PI_HOLE_BLOCKPAGE_DIR}/index.js" ]]; then
@@ -1721,10 +1715,8 @@ installCron() {
     local str="Installing latest Cron script"
     printf "\\n  %b %s..." "${INFO}" "${str}"
     # Copy the cron file over from the local repo
-    cp ${PI_HOLE_LOCAL_REPO}/advanced/Templates/pihole.cron /etc/cron.d/pihole
     # File must not be world or group writeable and must be owned by root
-    chmod 644 /etc/cron.d/pihole
-    chown root:root /etc/cron.d/pihole
+    install -D -m 644 -T -o root -g root ${PI_HOLE_LOCAL_REPO}/advanced/Templates/pihole.cron /etc/cron.d/pihole
     # Randomize gravity update time
     sed -i "s/59 1 /$((1 + RANDOM % 58)) $((3 + RANDOM % 2))/" /etc/cron.d/pihole
     # Randomize update checker time
@@ -1855,8 +1847,7 @@ installLogrotate() {
     local str="Installing latest logrotate script"
     printf "\\n  %b %s..." "${INFO}" "${str}"
     # Copy the file over from the local repo
-    cp ${PI_HOLE_LOCAL_REPO}/advanced/Templates/logrotate /etc/pihole/logrotate
-    chmod 644 /etc/pihole/logrotate
+    install -D -m 644 -T ${PI_HOLE_LOCAL_REPO}/advanced/Templates/logrotate /etc/pihole/logrotate
     # Different operating systems have different user / group
     # settings for logrotate that makes it impossible to create
     # a static logrotate file that will work with e.g.
@@ -2120,6 +2111,8 @@ checkout_pull_branch() {
     printf "  %b %s" "${INFO}" "$str"
     git checkout "${branch}" --quiet || return 1
     printf "%b  %b %s\\n" "${OVER}" "${TICK}" "$str"
+    # Data in the repositories is public anyway so we can make it readable by everyone (+r to keep executable permission if already set by git)
+    chmod -R a+r "${directory}"
 
     git_pull=$(git pull || return 1)
 
@@ -2532,8 +2525,7 @@ main() {
         # Display welcome dialogs
         welcomeDialogs
         # Create directory for Pi-hole storage
-        mkdir -p /etc/pihole/
-        chmod 755 /ect/pihole/
+        install -d -m 755 /etc/pihole/
         # Determine available interfaces
         get_available_interfaces
         # Find interfaces and let the user choose one

From 69c06ba6fe18e07f3b5611e8d849a996ff1931f1 Mon Sep 17 00:00:00 2001
From: pvogt09 <50047961+pvogt09@users.noreply.github.com>
Date: Sun, 5 May 2019 00:32:10 +0200
Subject: [PATCH 04/13] Sets permissions for dnsmaq.conf

Signed-off-by: pvogt09 <50047961+pvogt09@users.noreply.github.com>
---
 automated install/basic-install.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/automated install/basic-install.sh b/automated install/basic-install.sh
index 0d574f20..208bfe7c 100755
--- a/automated install/basic-install.sh	
+++ b/automated install/basic-install.sh	
@@ -1366,6 +1366,7 @@ installConfigs() {
     # Format: Name;Primary IPv4;Secondary IPv4;Primary IPv6;Secondary IPv6
     # Some values may be empty (for example: DNS servers without IPv6 support)
     echo "${DNS_SERVERS}" > "${PI_HOLE_CONFIG_DIR}/dns-servers.conf"
+    chmod 644 "${PI_HOLE_CONFIG_DIR}/dns-servers.conf"
 
     # Install empty file if it does not exist
     if [[ ! -r "${PI_HOLE_CONFIG_DIR}/pihole-FTL.conf" ]]; then
@@ -1692,7 +1693,7 @@ installPiholeWeb() {
     local str="Installing sudoer file"
     printf "\\n  %b %s..." "${INFO}" "${str}"
     # Make the .d directory if it doesn't exist
-    mkdir -p /etc/sudoers.d/
+    install -d -m 755 /etc/sudoers.d/
     # and copy in the pihole sudoers file
     install -m 0640 ${PI_HOLE_LOCAL_REPO}/advanced/Templates/pihole.sudo /etc/sudoers.d/pihole
     # Add lighttpd user (OS dependent) to sudoers file
@@ -2259,6 +2260,7 @@ disable_dnsmasq() {
     fi
     # Create /etc/dnsmasq.conf
     echo "conf-dir=/etc/dnsmasq.d" > "${conffile}"
+    chmod 644 "${conffile}"
 }
 
 get_binary_name() {

From a25f331e83c94320b634b7954d071a0688ff4730 Mon Sep 17 00:00:00 2001
From: pvogt09 <50047961+pvogt09@users.noreply.github.com>
Date: Sun, 5 May 2019 09:20:49 +0200
Subject: [PATCH 05/13] Adds chmod 644 for /var/www and /var/www/html

Signed-off-by: pvogt09 <50047961+pvogt09@users.noreply.github.com>
---
 automated install/basic-install.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/automated install/basic-install.sh b/automated install/basic-install.sh
index 208bfe7c..79a6c94a 100755
--- a/automated install/basic-install.sh	
+++ b/automated install/basic-install.sh	
@@ -867,6 +867,8 @@ setIFCFG() {
         echo "DNS2=$PIHOLE_DNS_2"
         echo "USERCTL=no"
         }> "${IFCFG_FILE}"
+        chmod 644 "${IFCFG_FILE}"
+        chown root:root "${IFCFG_FILE}"
         # Use ip to immediately set the new address
         ip addr replace dev "${PIHOLE_INTERFACE}" "${IPV4_ADDRESS}"
         # If NetworkMangler command line interface exists and ready to mangle,
@@ -1896,6 +1898,8 @@ installPihole() {
             # make the Web directory if necessary
             install -d -m 0755 ${webroot}
         fi
+        chmod a+rx /var/www
+        chmod a+rx /var/www/html
 
         if [[ "${INSTALL_WEB_SERVER}" == true ]]; then
             # Set the owner and permissions

From e19adccd9c623eeba20e46a6347108e917af133e Mon Sep 17 00:00:00 2001
From: pvogt09 <50047961+pvogt09@users.noreply.github.com>
Date: Sun, 5 May 2019 22:34:13 +0200
Subject: [PATCH 06/13] Moves chmod for /var/www/html into INSTALL_WEB_SERVER
 block

Signed-off-by: pvogt09 <50047961+pvogt09@users.noreply.github.com>
---
 automated install/basic-install.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/automated install/basic-install.sh b/automated install/basic-install.sh
index 79a6c94a..da1a6f9b 100755
--- a/automated install/basic-install.sh	
+++ b/automated install/basic-install.sh	
@@ -1898,13 +1898,14 @@ installPihole() {
             # make the Web directory if necessary
             install -d -m 0755 ${webroot}
         fi
-        chmod a+rx /var/www
-        chmod a+rx /var/www/html
 
         if [[ "${INSTALL_WEB_SERVER}" == true ]]; then
             # Set the owner and permissions
             chown ${LIGHTTPD_USER}:${LIGHTTPD_GROUP} ${webroot}
             chmod 0775 ${webroot}
+            # Repair permissions if /var/www/html is not world readable
+            chmod a+rx /var/www
+            chmod a+rx /var/www/html
             # Give pihole access to the Web server group
             usermod -a -G ${LIGHTTPD_GROUP} pihole
             # If the lighttpd command is executable,

From 4d23b3267f1ff16a4392c481f7e84473dd42649c Mon Sep 17 00:00:00 2001
From: pvogt09 <50047961+pvogt09@users.noreply.github.com>
Date: Tue, 7 May 2019 10:46:16 +0200
Subject: [PATCH 07/13] Adds X to chmod for git operations

Signed-off-by: pvogt09 <50047961+pvogt09@users.noreply.github.com>
---
 automated install/basic-install.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/automated install/basic-install.sh b/automated install/basic-install.sh
index da1a6f9b..585896c1 100755
--- a/automated install/basic-install.sh	
+++ b/automated install/basic-install.sh	
@@ -415,7 +415,7 @@ make_repo() {
     # Clone the repo and return the return code from this command
     git clone -q --depth 1 "${remoteRepo}" "${directory}" &> /dev/null || return $?
     # Data in the repositories is public anyway so we can make it readable by everyone (+r to keep executable permission if already set by git)
-    chmod -R a+r "${directory}"
+    chmod -R a+rX "${directory}"
     # Show a colored message showing it's status
     printf "%b  %b %s\\n" "${OVER}" "${TICK}" "${str}"
     # Always return 0? Not sure this is correct
@@ -450,7 +450,7 @@ update_repo() {
     # Show a completion message
     printf "%b  %b %s\\n" "${OVER}" "${TICK}" "${str}"
     # Data in the repositories is public anyway so we can make it readable by everyone (+r to keep executable permission if already set by git)
-    chmod -R a+r "${directory}"
+    chmod -R a+rX "${directory}"
     # Move back into the original directory
     cd "${curdir}" &> /dev/null || return 1
     return 0
@@ -499,7 +499,7 @@ resetRepo() {
     # Use git to remove the local changes
     git reset --hard &> /dev/null || return $?
     # Data in the repositories is public anyway so we can make it readable by everyone (+r to keep executable permission if already set by git)
-    chmod -R a+r "${directory}"
+    chmod -R a+rX "${directory}"
     # And show the status
     printf "%b  %b %s\\n" "${OVER}" "${TICK}" "${str}"
     # Returning success anyway?
@@ -2118,7 +2118,7 @@ checkout_pull_branch() {
     git checkout "${branch}" --quiet || return 1
     printf "%b  %b %s\\n" "${OVER}" "${TICK}" "$str"
     # Data in the repositories is public anyway so we can make it readable by everyone (+r to keep executable permission if already set by git)
-    chmod -R a+r "${directory}"
+    chmod -R a+rX "${directory}"
 
     git_pull=$(git pull || return 1)
 

From 2e6198077d8f505415b8f494357eb40cdec12277 Mon Sep 17 00:00:00 2001
From: pvogt09 <50047961+pvogt09@users.noreply.github.com>
Date: Thu, 9 May 2019 12:23:44 +0200
Subject: [PATCH 08/13] chmod 644 adlists.list

Signed-off-by: pvogt09 <50047961+pvogt09@users.noreply.github.com>
---
 automated install/basic-install.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/automated install/basic-install.sh b/automated install/basic-install.sh
index 585896c1..00c5c95a 100755
--- a/automated install/basic-install.sh	
+++ b/automated install/basic-install.sh	
@@ -1193,6 +1193,7 @@ chooseBlocklists() {
     do
         appendToListsFile "${choice}"
     done
+    chmod 644 "${adlistFile}"
 }
 
 # Accept a string parameter, it must be one of the default lists

From a3d2a1062fe12f4da89c21274b8228c133dd5bfa Mon Sep 17 00:00:00 2001
From: pvogt09 <50047961+pvogt09@users.noreply.github.com>
Date: Fri, 10 May 2019 11:13:19 +0200
Subject: [PATCH 09/13] Makes blocklists world readable

Signed-off-by: pvogt09 <50047961+pvogt09@users.noreply.github.com>
---
 gravity.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/gravity.sh b/gravity.sh
index a2f2c782..445274ce 100755
--- a/gravity.sh
+++ b/gravity.sh
@@ -328,6 +328,7 @@ gravity_DownloadBlocklistFromUrl() {
 # Parse source files into domains format
 gravity_ParseFileIntoDomains() {
   local source="${1}" destination="${2}" firstLine abpFilter
+  chmod 644 "${source}"
 
   # Determine if we are parsing a consolidated list
   if [[ "${source}" == "${piholeDir}/${matterAndLight}" ]]; then
@@ -345,6 +346,7 @@ gravity_ParseFileIntoDomains() {
     sed -r '/(\/|#).*$/d' | \
     sed -r 's/^.*\s+//g' | \
     sed -r '/([^\.]+\.)+[^\.]{2,}/!d' >  "${destination}"
+    chmod 644 "${destination}"
     return 0
   fi
 
@@ -375,6 +377,7 @@ gravity_ParseFileIntoDomains() {
       if($0 ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/) { $0="" }
       if($0) { print $0 }
     }' "${source}" > "${destination}"
+    chmod 644 "${destination}"
 
     # Determine if there are Adblock exception rules
     # https://adblockplus.org/filters
@@ -391,6 +394,7 @@ gravity_ParseFileIntoDomains() {
 
       # Remove exceptions
       comm -23 "${destination}" <(sort "${destination}.exceptionsFile.tmp") > "${source}"
+	  chmod 644 "${source}"
       mv "${source}" "${destination}"
     fi
 
@@ -427,6 +431,7 @@ gravity_ParseFileIntoDomains() {
       gravity_Cleanup "error"
     fi
   fi
+  chmod 644 "${destination}"
 }
 
 # Create (unfiltered) "Matter and Light" consolidated list
@@ -440,6 +445,7 @@ gravity_ConsolidateDownloadedBlocklists() {
 
   # Empty $matterAndLight if it already exists, otherwise, create it
   : > "${piholeDir}/${matterAndLight}"
+  chmod 644 "${piholeDir}/${matterAndLight}"
 
   # Loop through each *.domains file
   for i in "${activeDomains[@]}"; do

From e076db5a4e1e15cb9d8e8707bf2a5da7be125489 Mon Sep 17 00:00:00 2001
From: pvogt09 <50047961+pvogt09@users.noreply.github.com>
Date: Fri, 10 May 2019 11:19:28 +0200
Subject: [PATCH 10/13] Changes ownership of macvendor.db to pihole

Signed-off-by: pvogt09 <50047961+pvogt09@users.noreply.github.com>
---
 automated install/basic-install.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/automated install/basic-install.sh b/automated install/basic-install.sh
index 00c5c95a..a00aee16 100755
--- a/automated install/basic-install.sh	
+++ b/automated install/basic-install.sh	
@@ -2216,6 +2216,8 @@ FTLinstall() {
 
             # Before stopping FTL, we download the macvendor database
             curl -sSL "https://ftl.pi-hole.net/macvendor.db" -o "${PI_HOLE_CONFIG_DIR}/macvendor.db" || true
+            chmod 644 "${PI_HOLE_CONFIG_DIR}/macvendor.db"
+            chown pihole:pihole "${PI_HOLE_CONFIG_DIR}/macvendor.db"
 
             # Stop pihole-FTL service if available
             stop_service pihole-FTL &> /dev/null

From 225285cb977ced4047de542978749c35a3ee43bf Mon Sep 17 00:00:00 2001
From: pvogt09 <50047961+pvogt09@users.noreply.github.com>
Date: Sat, 11 May 2019 11:14:07 +0200
Subject: [PATCH 11/13] Removes chmod for ${source} and superfluous chmod for
 ${destination}

Signed-off-by: pvogt09 <50047961+pvogt09@users.noreply.github.com>
---
 gravity.sh | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/gravity.sh b/gravity.sh
index 445274ce..8fdfa5d7 100755
--- a/gravity.sh
+++ b/gravity.sh
@@ -328,7 +328,6 @@ gravity_DownloadBlocklistFromUrl() {
 # Parse source files into domains format
 gravity_ParseFileIntoDomains() {
   local source="${1}" destination="${2}" firstLine abpFilter
-  chmod 644 "${source}"
 
   # Determine if we are parsing a consolidated list
   if [[ "${source}" == "${piholeDir}/${matterAndLight}" ]]; then
@@ -377,7 +376,6 @@ gravity_ParseFileIntoDomains() {
       if($0 ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/) { $0="" }
       if($0) { print $0 }
     }' "${source}" > "${destination}"
-    chmod 644 "${destination}"
 
     # Determine if there are Adblock exception rules
     # https://adblockplus.org/filters
@@ -394,7 +392,6 @@ gravity_ParseFileIntoDomains() {
 
       # Remove exceptions
       comm -23 "${destination}" <(sort "${destination}.exceptionsFile.tmp") > "${source}"
-	  chmod 644 "${source}"
       mv "${source}" "${destination}"
     fi
 

From 3f90261520aae689e213637bc27d0754ab0ce97b Mon Sep 17 00:00:00 2001
From: pvogt09 <50047961+pvogt09@users.noreply.github.com>
Date: Sun, 12 May 2019 11:25:48 +0200
Subject: [PATCH 12/13] Moves chmod after every creation of ${destination}
 instead of end of function

Signed-off-by: pvogt09 <50047961+pvogt09@users.noreply.github.com>
---
 gravity.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/gravity.sh b/gravity.sh
index 8fdfa5d7..2a22b792 100755
--- a/gravity.sh
+++ b/gravity.sh
@@ -376,6 +376,7 @@ gravity_ParseFileIntoDomains() {
       if($0 ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/) { $0="" }
       if($0) { print $0 }
     }' "${source}" > "${destination}"
+    chmod 644 "${destination}"
 
     # Determine if there are Adblock exception rules
     # https://adblockplus.org/filters
@@ -393,6 +394,7 @@ gravity_ParseFileIntoDomains() {
       # Remove exceptions
       comm -23 "${destination}" <(sort "${destination}.exceptionsFile.tmp") > "${source}"
       mv "${source}" "${destination}"
+      chmod 644 "${destination}"
     fi
 
     echo -e "${OVER}  ${TICK} Format: Adblock"
@@ -416,11 +418,13 @@ gravity_ParseFileIntoDomains() {
       # Print if nonempty
       length { print }
     ' "${source}" 2> /dev/null > "${destination}"
+    chmod 644 "${destination}"
 
     echo -e "${OVER}  ${TICK} Format: URL"
   else
     # Default: Keep hosts/domains file in same format as it was downloaded
     output=$( { mv "${source}" "${destination}"; } 2>&1 )
+    chmod 644 "${destination}"
 
     if [[ ! -e "${destination}" ]]; then
       echo -e "\\n  ${CROSS} Unable to move tmp file to ${piholeDir}
@@ -428,7 +432,6 @@ gravity_ParseFileIntoDomains() {
       gravity_Cleanup "error"
     fi
   fi
-  chmod 644 "${destination}"
 }
 
 # Create (unfiltered) "Matter and Light" consolidated list

From efbd42f7b5e7a9532aeefa13ff1965cb62d67981 Mon Sep 17 00:00:00 2001
From: pvogt09 <50047961+pvogt09@users.noreply.github.com>
Date: Sun, 12 May 2019 11:27:25 +0200
Subject: [PATCH 13/13] Moves creation of pihole user before FTL installation

Signed-off-by: pvogt09 <50047961+pvogt09@users.noreply.github.com>
---
 automated install/basic-install.sh | 5 ++---
 test/test_automated_install.py     | 9 +++++++++
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/automated install/basic-install.sh b/automated install/basic-install.sh
index a00aee16..9520c44c 100755
--- a/automated install/basic-install.sh	
+++ b/automated install/basic-install.sh	
@@ -1890,9 +1890,6 @@ accountForRefactor() {
 
 # Install base files and web interface
 installPihole() {
-    # Create the pihole user
-    create_pihole_user
-
     # If the user wants to install the Web interface,
     if [[ "${INSTALL_WEB_INTERFACE}" == true ]]; then
         if [[ ! -d "${webroot}" ]]; then
@@ -2591,6 +2588,8 @@ main() {
     else
         LIGHTTPD_ENABLED=false
     fi
+    # Create the pihole user
+    create_pihole_user
     # Check if FTL is installed - do this early on as FTL is a hard dependency for Pi-hole
     if ! FTLdetect; then
         printf "  %b FTL Engine not installed\\n" "${CROSS}"
diff --git a/test/test_automated_install.py b/test/test_automated_install.py
index 853048d1..282c627d 100644
--- a/test/test_automated_install.py
+++ b/test/test_automated_install.py
@@ -398,6 +398,7 @@ def test_FTL_detect_aarch64_no_errors(Pihole):
     )
     detectPlatform = Pihole.run('''
     source /opt/pihole/basic-install.sh
+    create_pihole_user
     FTLdetect
     ''')
     expected_stdout = info_box + ' FTL Checks...'
@@ -418,6 +419,7 @@ def test_FTL_detect_armv6l_no_errors(Pihole):
     mock_command('ldd', {'/bin/ls': ('/lib/ld-linux-armhf.so.3', '0')}, Pihole)
     detectPlatform = Pihole.run('''
     source /opt/pihole/basic-install.sh
+    create_pihole_user
     FTLdetect
     ''')
     expected_stdout = info_box + ' FTL Checks...'
@@ -439,6 +441,7 @@ def test_FTL_detect_armv7l_no_errors(Pihole):
     mock_command('ldd', {'/bin/ls': ('/lib/ld-linux-armhf.so.3', '0')}, Pihole)
     detectPlatform = Pihole.run('''
     source /opt/pihole/basic-install.sh
+    create_pihole_user
     FTLdetect
     ''')
     expected_stdout = info_box + ' FTL Checks...'
@@ -455,6 +458,7 @@ def test_FTL_detect_x86_64_no_errors(Pihole):
     '''
     detectPlatform = Pihole.run('''
     source /opt/pihole/basic-install.sh
+    create_pihole_user
     FTLdetect
     ''')
     expected_stdout = info_box + ' FTL Checks...'
@@ -471,6 +475,7 @@ def test_FTL_detect_unknown_no_errors(Pihole):
     mock_command('uname', {'-m': ('mips', '0')}, Pihole)
     detectPlatform = Pihole.run('''
     source /opt/pihole/basic-install.sh
+    create_pihole_user
     FTLdetect
     ''')
     expected_stdout = 'Not able to detect architecture (unknown: mips)'
@@ -484,6 +489,7 @@ def test_FTL_download_aarch64_no_errors(Pihole):
     download_binary = Pihole.run('''
     source /opt/pihole/basic-install.sh
     binary="pihole-FTL-aarch64-linux-gnu"
+    create_pihole_user
     FTLinstall
     ''')
     expected_stdout = tick_box + ' Downloading and Installing FTL'
@@ -498,6 +504,7 @@ def test_FTL_download_unknown_fails_no_errors(Pihole):
     download_binary = Pihole.run('''
     source /opt/pihole/basic-install.sh
     binary="pihole-FTL-mips"
+    create_pihole_user
     FTLinstall
     ''')
     expected_stdout = cross_box + ' Downloading and Installing FTL'
@@ -514,6 +521,7 @@ def test_FTL_download_binary_unset_no_errors(Pihole):
     '''
     download_binary = Pihole.run('''
     source /opt/pihole/basic-install.sh
+    create_pihole_user
     FTLinstall
     ''')
     expected_stdout = cross_box + ' Downloading and Installing FTL'
@@ -530,6 +538,7 @@ def test_FTL_binary_installed_and_responsive_no_errors(Pihole):
     '''
     installed_binary = Pihole.run('''
     source /opt/pihole/basic-install.sh
+    create_pihole_user
     FTLdetect
     pihole-FTL version
     ''')