linux-kernel - Re: R: Linux kernel source archive vulnerable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ee8a8j$gf7$1@taverner.cs.berkeley.edu>
Date:	Wed, 13 Sep 2006 06:59:31 +0000 (UTC)
From:	daw@...berkeley.edu (David Wagner)
To:	linux-kernel@...r.kernel.org
Subject: Re: R: Linux kernel source archive vulnerable

Kyle Moffett  wrote:
>No, git-tar-tree is storing the desired permissions (0666 and 0777)  
>in the tar archive.  This is not a bug, those are actually the  
>permissions we want in the tar archive.

Those may be the permissions *you* want, but they're not the permissions
I suspect many users would prefer.  Take a look at any open-source
project that ships tar archives of their source code.  Do they ship
tarballs of their source code where all the files have 0666 permissions?
Not in my experience.  That should tell you something.

Telling me that this is "by design" is not a very persuasive response
when my claim is that the design is poorly chosen.

>No, it is user-friendly.  This is like distributing programs who use  
>open(..., 0666) when opening globally-readable files.

It's not the same.  There's a reason that most other open-source
projects are careful not to distribute 0666 files in their tar archives.

>o   Do *not* extract kernel trees as root

I don't see anything unreasonable about extracting tarballs from a
trusted source as root (unless, of course, the folks who put together
the tarballs are malicious or careless or can't be trusted).

I don't see any good justification for this other than that the
maintainers of git-tar-tree can't be bothered to store more reasonable
permissions in the tar archive.  It smells like a workaround that is
designed to make the lives of the git-tar-tree programmers easier --
but at the cost of making users lives a little harder.  That's what I
mean when I said that this decision doesn't seem very user-friendly.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/