mainSavannah Administration - Support: sr #111001, unsafe permission in www-zh-cn CVS...

 
 

sr #111001: unsafe permission in www-zh-cn CVS source repo

Submitter:  Jing Luo <jing>
Submitted:  Fri 05 Jan 2024 04:28:38 AM UTC
   
 
Category:  Source code repositories - developer access Priority:  5 - Normal
Severity:  2 - Minor Status:  Done
Privacy:  Public Assigned to:  ineiev
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Fri 16 Feb 2024 05:54:49 AM UTC, comment #7: 

I've cleared the execution bit in all files in www-zh-cn CVS source repository; the rest is up to the team.

Ineiev <ineiev>
Site Administrator
Sat 10 Feb 2024 04:22:07 PM UTC, comment #6: 

git config seems to have an option to ignore file mode. Looks like cvs can't do that. Ideally wxie would ask the contributors to stop using any non POSIX compliant filesystem so this won't happen again.

Jing Luo <jing>
Group Member
Sat 06 Jan 2024 05:56:46 PM UTC, comment #5: 

TTBOMK, the executable attribute in the repository is set during the first commit and then persists.

In my working copy, I can chmod -x file, and the file will be non-executable until I rm file; cvs up file---and then the executable bit is fetched from the repository again.

Likewise, that bit is set when checking out a fresh working copy.

Removing and re-adding file doesn't help, like mv file{,~}; cvs rm file; cvs ci -m'removing' file; mv file{~,}; chmod -x file; cvs add file; cvs ci -m're-adding' file

So it looks like in Savannah environment only Savannah admins can reset those bits, like chmod -x file,v; but it makes little sense to do that if other such files be added subsequently.

Ineiev <ineiev>
Site Administrator
Sat 06 Jan 2024 01:38:08 AM UTC, comment #4: 

Thank you for the report.

1. I have checked my local working files recently. None of them are with executable attribute.

2. Is there a way using CVS commit to automatically modify the file attribute before check in? e.g.

<code>
chmod 644 file.po | cvs commit -m file.po
</code>

3. Will the older revisions of files still have executable attribute after new commit?

Wensheng XIE <wxie>
Fri 05 Jan 2024 10:21:31 PM UTC, comment #3: 

Technically those permissions are not unsafe, at least they are not unsafe for Savannah.  That's the context in which I make this comment.

CVS is based upon RCS and both of those use the permissions on the ,v file to specify the file mode to be used when the file is checked out.  That information might possibly have been stored in the ,v file as a data field back decades ago when the file was defined but instead this information is stored in the file mode itself.

It's an interesting question though.  Could a malicious attacker use an executable ,v file in some way?  And I add in some way more effectively than being able to use other commands?  Because being able to execute this arbitrary path means they would be able to execute other arbitrary paths, most likely.  And in that case I can think of many other more effective attacks.  Regardless this could only be used as a secondary layer of attack after already being able to execute the primary successfully by being able to invoke arbitrary executables.

Being curious I looked and ran a find command across the entire CVS collection and located 100943 ,v files stored in the repositories that are marked executable.  That includes a lot of files that are scripts and should be marked executable.  Which is just to say that this is not something that is isolated to the translations.

Though certainly in the translations there is no need for these files to be executable.  It would be very good for the translations to clean this up with a commit from their working copy sandbox to clean up these.

Bob Proulx <rwp>
Site Administrator
Fri 05 Jan 2024 07:09:33 AM UTC, comment #2: 

We could clear that bit in the attributes, but

  1. technically, such changes should come from the admins of the respective groups, and
  2. that wouldn't fix the issue if people proceed with adding files with such attributes.
Ineiev <ineiev>
Site Administrator
Fri 05 Jan 2024 04:33:34 AM UTC, comment #1: 

forgot the ,v in the end of the file names, oops

Jing Luo <jing>
Group Member
Fri 05 Jan 2024 04:28:38 AM UTC, original submission:  

Hi,

I discovered that some po files in www-zh-cn CVS source repo have mode 755 instead of 644, which could be unsafe. IIUC Only cvs admin can change the file permission. I suspect some contributors uploaded the files while using a non-POSIX filesystem (or CVSNT?).

These are the files for your convenience, if you can & want to correct the permission:

chmod -x /cvsroot/www-zh-cn/www-zh-cn/philosophy/why-copyleft.zh-cn.po
chmod -x /cvsroot/www-zh-cn/www-zh-cn/philosophy/correcting-france-mistake.zh-cn.po
chmod -x /cvsroot/www-zh-cn/www-zh-cn/philosophy/copyright-and-globalization.zh-cn.po
chmod -x /cvsroot/www-zh-cn/www-zh-cn/philosophy/copyright-versus-community-2000.zh-cn.po
chmod -x /cvsroot/www-zh-cn/www-zh-cn/philosophy/copyright-versus-community.zh-cn.po
chmod -x /cvsroot/www-zh-cn/www-zh-cn/education/how-i-fought-to-graduate-without-using-non-free-software.zh-cn.po

Thanks.

Jing Luo <jing>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wxie (Posted a comment)
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by jing (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-02-16 ineiev StatusNeed Info Done
        Open/ClosedOpen Closed
    2024-01-05 ineiev StatusNone Need Info
        Assigned toNone ineiev
        Operating SystemGNU/Linux None

    Back to the top

    Powered by Savane 3.13-3e34.
    Corresponding source code