[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 24 Sep 2012 20:54:31 +0200
From: Tavis Ormandy <taviso@...xchg8b.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files
Kurt Seifried <kseifried@...hat.com> wrote:
> On 09/24/2012 11:15 AM, Kurt Seifried wrote:
> > On 09/24/2012 02:42 AM, Tavis Ormandy wrote:
> > > Matthias Weckbecker <mweckbecker@...e.de> wrote:
> >
> > > > On Friday 21 September 2012 23:47:48 Michael Gilbert wrote: [...]
> >>>>
> > > > > So anyway, I suppose this creates more questions than answers, but
> > > > > I guess its worth thinking about. After all, what did the user
> > > > > really expect? If they had intended that original file to be
> > > > > private, and now its not, is that appropriate? Is it more
> > > > > appropriate to assume all users know how to use umask
> > > > > appropriately?
> >>>>
> >>>
> > > > IMO if one bothers to encrypt a file at all it was certainly
> > > > intended to be private and only supposed to be readable by a certain
> > > > user / user group and not by just everyone. Otherwise encryption
> > > > would be pointless, or are there any other reasons for encrypting a
> > > > file?
> >>>
> > > > > Best wishes, Mike
> >>>
> > > > Thanks, Matthias
> >>>
> >
> > > I agree. Users do know how to use umask properly, but this isn't what
> > > umask is for. The umask for the low order bits are only applied if the
> > > program requested 0666, it's still the responsibility of the program
> > > to choose the appropriate permissions.
> >
> > > Creating sensitive files with 0666 and then saying "set your umask" is
> > > just wrong.
> >
> > > Tavis.
> >
> > So where do we draw the line? tar? By this definition any program that
> > has stores sensitive data (passwords/etc.) or has potentially sensitive
> > output (so email, web clients, chat clients, file downloaders, text
> > editors, etc.) needs to internally pick some "safe" default and apply it
> > and/or umask (whichever is more secure I guess).
> >
Then lets just remove umask, because you're saying it's useless. The purpose
of umask is to apply a *mask* to what applications request as default, not
as a universal "set these permissions" command. If it was, it would be
called uperms.
And yes, I think that any program that creates files with sensitive contents
and requests 0666 is broken.
Tavis.
--
-------------------------------------
taviso@...xchg8b.com | pgp encrypted mail preferred
-------------------------------------------------------
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
