bugManeage - Bugs: bug #58658, A generic enabling of execute...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #58658: A generic enabling of execute flags is an insecure default

Submitter:  Boud Roukema <boud>
Submitted:  Fri 26 Jun 2020 03:05:27 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  Enhancement Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open

Fri 26 Jun 2020 03:05:27 PM UTC, original submission:  

This seems to me to be a security bug - not urgent - but we do
want to encourage secure coding practices by users.

Disable chmod of shell file executable flags by default

Prior to this commit, every time `./project` is run, the
files in several directories where executable shell scripts
are expected to be found have `chmod +x` applied to them.

This earlier behaviour is risky in terms of security, because
users may place files that are not intended to be executable
scripts in these directories. While such a choice would normally
that would decrease the clarity of the project, there could be
situations where this is reasonable - e.g. as a temporary hack.

In particular, users may keep backup copies of modified scripts
in these directories, which they try to disable by using `chmod
ugo-x`. Backup copies of scripts created automatically could
include, for example, `reproduce/software/shell/configure.sh~`.

It is also risky to give execute rights to the `group` and
`other` categories of users, since by default, execute privileges
on files should not be given to those users who do not need it.

When running `./project`, especially during analysis stages, the
situation before this commit assumes that the user knows the full
consequences of the `project` script and is aware that s/he has
to override them by editing `project` if s/he wishes to minimise
execute privileges on files.

With this commit, a new option to `./project --configure` is
provided, --enable-shell-execute-flag. This only does `chmod u+x`,
not `chmod +x`.

By default, this new option is disabled, so the default behaviour
differs from earlier commits. However, the `chmod u+x` action is
enabled during initial configure, when `--existing-conf` is not
(yet) chosen by the user.

The comments in `project` are modified to take into account these
updates.

TODO: I'm not sure how this relates to the `group` mode of `maneage`,
which might require `ug+x`.

PROPOSED FIX:
https://codeberg.org/boud/maneage_dev/src/branch/security_chmod_flag

https://codeberg.org/boud/maneage_dev/commit/4124fa6949c8657d171a430ef9ca4476b3ec9e93

Boud Roukema <boud>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by boud (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.14-f13d.
    Corresponding source code