Re: Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files

[Tavis Ormandy <taviso () cmpxchg8b com>]

Kurt Seifried <kseifried () redhat com> wrote:

> On 09/24/2012 11:15 AM, Kurt Seifried wrote:
> > On 09/24/2012 02:42 AM, Tavis Ormandy wrote:
> > > Matthias Weckbecker <mweckbecker () suse de> wrote:
> >
> > > > On Friday 21 September 2012 23:47:48 Michael Gilbert wrote: [...]
> > > > > So anyway, I suppose this creates more questions than answers, but
> > > > > I guess its worth thinking about.  After all, what did the user
> > > > > really expect?  If they had intended that original file to be
> > > > > private, and now its not, is that appropriate?  Is it more
> > > > > appropriate to assume all users know how to use umask
> > > > > appropriately?
> > > >
> > > > IMO if one bothers to encrypt a file at all it was certainly
> > > > intended to be private and only supposed to be readable by a certain
> > > > user / user group and not by just everyone. Otherwise encryption
> > > > would be pointless, or are there any other reasons for encrypting a
> > > > file?
> > > >
> > > > > Best wishes, Mike
> > > >
> > > > Thanks, Matthias
> >
> > > I agree. Users do know how to use umask properly, but this isn't what
> > > umask is for. The umask for the low order bits are only applied if the
> > > program requested 0666, it's still the responsibility of the program
> > > to choose the appropriate permissions.
> >
> > > Creating sensitive files with 0666 and then saying "set your umask" is
> > > just wrong.
> >
> > > Tavis.
> >
> > So where do we draw the line? tar? By this definition any program that
> > has stores sensitive data (passwords/etc.) or has potentially sensitive
> > output (so email, web clients, chat clients, file downloaders, text
> > editors, etc.) needs to internally pick some "safe" default and apply it
> > and/or umask (whichever is more secure I guess).

Then lets just remove umask, because you're saying it's useless. The purpose
of umask is to apply a *mask* to what applications request as default, not
as a universal "set these permissions" command. If it was, it would be
called uperms.

And yes, I think that any program that creates files with sensitive contents
and requests 0666 is broken.

Tavis.

-- 
-------------------------------------
taviso () cmpxchg8b com | pgp encrypted mail preferred
-------------------------------------------------------