Ticket #127 (new defect)
Opened 5 months ago
Incorrect permissions applied to symlink source directories
| Reported by: | blee | Owned by: | confman-developers@… |
|---|---|---|---|
| Priority: | critical | Milestone: | confman-1.9.4 |
| Component: | confman | Version: | 1.9.3b |
| Keywords: | Cc: |
Description
Consider the following example:
blee@supra ~/src/conf $ ls -ld /usr/src/linux-2.6.32-gentoo-r5 drwxr-xr-x 24 root root 4096 Feb 24 00:21 /usr/src/linux-2.6.32-gentoo-r5 blee@supra ~/src/conf $ ls -l /usr/src/linux lrwxrwxrwx 1 root root 22 Feb 13 20:59 /usr/src/linux -> linux-2.6.32-gentoo-r5 blee@supra ~/src/conf $ confman import supra /usr/src/linux/.config Making directory /usr with root:root, 755 Making directory /usr/src with root:root, 755 Making directory /usr/src/linux with root:root, 777 /usr/bin/svn mkdir /home/blee/src/conf/supra/usr/src/linux A /home/blee/src/conf/supra/usr/src/linux property 'confman:owner' set on '/home/blee/src/conf/supra/usr/src/linux' property 'confman:group' set on '/home/blee/src/conf/supra/usr/src/linux' property 'confman:mode' set on '/home/blee/src/conf/supra/usr/src/linux' property 'confman:comment' set on '/home/blee/src/conf/supra/usr/src/linux' /usr/src/linux/.config A /home/blee/src/conf/supra/usr/src/linux/.config property 'svn:keywords' set on '/home/blee/src/conf/supra/usr/src/linux/.config' property 'confman:owner' set on '/home/blee/src/conf/supra/usr/src/linux/.config' property 'confman:group' set on '/home/blee/src/conf/supra/usr/src/linux/.config' property 'confman:mode' set on '/home/blee/src/conf/supra/usr/src/linux/.config' property 'confman:comment' set on '/home/blee/src/conf/supra/usr/src/linux/.config' property 'confman:symlink' set on '/home/blee/src/conf/supra/usr/src/linux/.config'
During the subsequent install operation, the permissions on /usr/src/linux-2.6.32-gentoo-r5 will be changed from 0755 to 0777. This could be a security risk if the source directory has restrictive permissions.
The simplest fix would be for install to apply permissions to symlink targets rather than their sources.
Note: See
TracTickets for help on using
tickets.
