Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

hashfile is world readable #262

Closed
ghen2 opened this issue Mar 1, 2021 · 0 comments · Fixed by #263
Closed

hashfile is world readable #262

ghen2 opened this issue Mar 1, 2021 · 0 comments · Fixed by #263

Comments

@ghen2
Copy link

ghen2 commented Mar 1, 2021

When duperemove creates a new hashfile, it gets created with the default umask, so typically 0644 or world readable by default.
This poses a security risk, as it contains directory listings and content hashes for files and directories that are otherwise protected by filesystem permissions.

The hashfile should be created with 0600 permissions only. (Ideally the sysadmin should create it in a private directory, but quick invocations will typically just use /tmp or similar)
lorddoskias added a commit to lorddoskias/duperemove that referenced this issue Mar 2, 2021
@lorddoskias
Create hash database file with 600 permission
b8814cb 
The argument was made that since the hashfile contains paths and
content hashesh for files and directories that are otherwise protected
by the filesystem permissions. Fix this by explicitly setting the
permissions for a newly created database file to 600.

close markfasheh#262
lorddoskias added a commit to lorddoskias/duperemove that referenced this issue Mar 2, 2021
@lorddoskias
Create hash database file with 600 permission
1682365 
The argument was made that since the hashfile contains paths and
content hashesh for files and directories that are otherwise protected
by the filesystem permissions. Fix this by explicitly setting the
permissions for a newly created database file to 600.

close markfasheh#262
@lorddoskias lorddoskias mentioned this issue Mar 2, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Create hash database file with 600 permission lorddoskias/duperemove
1 participant
@ghen2