oss-sec mailing list archives
Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files
From: Tavis Ormandy <taviso () cmpxchg8b com>
Date: Mon, 24 Sep 2012 10:42:09 +0200
Matthias Weckbecker <mweckbecker () suse de> wrote:
On Friday 21 September 2012 23:47:48 Michael Gilbert wrote: [...]So anyway, I suppose this creates more questions than answers, but I guess its worth thinking about. After all, what did the user really expect? If they had intended that original file to be private, and now its not, is that appropriate? Is it more appropriate to assume all users know how to use umask appropriately?IMO if one bothers to encrypt a file at all it was certainly intended to be private and only supposed to be readable by a certain user / user group and not by just everyone. Otherwise encryption would be pointless, or are there any other reasons for encrypting a file?Best wishes, MikeThanks, Matthias
I agree. Users do know how to use umask properly, but this isn't what umask is for. The umask for the low order bits are only applied if the program requested 0666, it's still the responsibility of the program to choose the appropriate permissions. Creating sensitive files with 0666 and then saying "set your umask" is just wrong. Tavis. -- ------------------------------------- taviso () cmpxchg8b com | pgp encrypted mail preferred -------------------------------------------------------
Current thread:
- Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files, (continued)
- Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Dan Rosenberg (Sep 21)
- Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Matthias Weckbecker (Sep 21)
- Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Tomas Mraz (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Kurt Seifried (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Kurt Seifried (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 21)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Matthias Weckbecker (Sep 24)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Tavis Ormandy (Sep 24)
- Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 24)
- Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Tavis Ormandy (Sep 24)
- Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 24)
- Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Tavis Ormandy (Sep 24)
- Re: Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 24)
- Re: Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 24)
- Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Michael Gilbert (Sep 21)
- Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Dan Rosenberg (Sep 21)
- Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Steven M. Christey (Sep 24)
- Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Matthias Weckbecker (Sep 25)
- Re: Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Kurt Seifried (Sep 26)
- Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files Patrick J. Volkerding (Sep 24)