[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87r4k2fm93.fsf@windlord.stanford.edu>
Date: Tue, 26 Feb 2013 19:50:48 -0800
From: Russ Allbery <rra@...nford.edu>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: psi+ stores the cache file as world-readable
gremlin@...mlin.ru writes:
> On 26-Feb-2013 23:04:24 +0100, Agostino Sarubbo wrote:
> > Psi+, a fork of psi, stores its files in ~/.cache/psi+ as
> > world-readable.
> That's normal - users' home directories are normally accessible
> only by users themselves, and never by othe users:
> gremlin@...n:~ > ls -ld .
> drwx-----x 47 gremlin users 20480 2013-02-26 17:48 ./
That is one possible convention of many for structuring user home
directory permissions. It is certainly not universal, and no software
should assume that home directory permissions are structured that way when
deciding on the permissions of other files created under the user's home
directory.
Some of us who have been using UNIX for long enough that we originally
learned the permissions system when sharing was emphasized over security
do still use world-readable home directories, with specific directories
under it restricted. We would like software, when creating private files,
to not assume that it can be careless about permissions of individual
files because "of course" the user's home directory is private.
--
Russ Allbery (rra@...nford.edu) <http://www.eyrie.org/~eagle/>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
