Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE request: psi+ stores the cache file as world-readable
From: Russ Allbery <rra () stanford edu>
Date: Tue, 26 Feb 2013 19:50:48 -0800

gremlin () gremlin ru writes:
On 26-Feb-2013 23:04:24 +0100, Agostino Sarubbo wrote:

 > Psi+, a fork of psi, stores its files in ~/.cache/psi+ as
 > world-readable.

That's normal - users' home directories are normally accessible
only by users themselves, and never by othe users:

gremlin () hren:~ > ls -ld .
drwx-----x 47 gremlin users 20480 2013-02-26 17:48 ./

That is one possible convention of many for structuring user home
directory permissions.  It is certainly not universal, and no software
should assume that home directory permissions are structured that way when
deciding on the permissions of other files created under the user's home

Some of us who have been using UNIX for long enough that we originally
learned the permissions system when sharing was emphasized over security
do still use world-readable home directories, with specific directories
under it restricted.  We would like software, when creating private files,
to not assume that it can be careless about permissions of individual
files because "of course" the user's home directory is private.

Russ Allbery (rra () stanford edu)             <http://www.eyrie.org/~eagle/>

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]