lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 13 Sep 2006 00:56:43 +0200 From: Rene Scharfe <rene.scharfe@...fire.ath.cx> To: David Wagner <daw-usenet@...erner.cs.berkeley.edu> CC: linux-kernel mailing list <linux-kernel@...r.kernel.org> Subject: Re: R: Linux kernel source archive vulnerable David Wagner schrieb: > You misunderstand my point. I don't care whether it is a tar bug or > not. I'm not claiming it is a tar bug. I'm saying that people on > those threads claimed that this is a tar bug and used that as an > excuse to do nothing about the problem of world-writeable files in > the Linux tar archive. I'm saying that's a lousy excuse. What I'm > saying is that, even if we accept that it is a tar bug, that's not a > good excuse for doing nothing about the problem. Of course, if it is > not a tar bug, then that makes it an even weaker excuse. GNU tar offers two options on how to interpret the security mode bits in a tar archive when you extract files from it: it either applies your umask or it doesn't. If you let it apply your umask and the mode in the archive is 0777 then the extracted files will get exactly the permission you want them to have. E.g. you could grant group write rights, all without running chmod. It may be unfortunate that GNU tar defaults to not apply the umask when run as root, thereby trusting the permissions in the archive. However, this is not a bug but rather a feature which made sense back when tar files were primarily used as backup files and not as transport containers. So, don't run tar in local backup restore mode if you deal with archives created by someone else, unless you want to set the permissions exactly as they are stored in the archive. If you are root then you should know that GNU tar defaults to the permission preserving mode and how to switch to umask applying mode. René - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists