2006-09-13 06:26:41

by David Wagner

[permalink] [raw]
Subject: Re: R: Linux kernel source archive vulnerable

Kyle Moffett wrote:
>On Sep 13, 2006, at 01:34:01, David Wagner wrote:
>> So it sounds like git-tar-tree has a bug; its default isn't setting
>> meaningful permissions on the files that it puts into the tar archive.
>> I hope the maintainers of git-tar-tree will consider fixing this bug.
>
>Let me reiterate: This is not a bug!

I think it is a bug. It sounds like git-tar-tree is storing the wrong
set of permissions in the tar archive. When I run "tar cf foo.tar
bar", and bar has permissions 0644, then tar inserts an entry into the
archive for "bar" with its permissions listed as 0644 (*not* 0666).
If "tar cf foo.tar bar" just ignored the permissions on bar and always
used a default of 0666 out of laziness, that would be a bug in "tar cf".
The same goes for git-tar-tree. It seems to me that git-tar-tree ought
to behave the same as "tar cf".

In any case, regardless of whether this is by design or not, it is not
courteous to your users to distribute tar files where all the files have
permissions 0666. That's not a user-friendly to do.


2006-09-13 06:49:51

by Kyle Moffett

[permalink] [raw]
Subject: Re: R: Linux kernel source archive vulnerable

On Sep 13, 2006, at 02:26:23, David Wagner wrote:
> Kyle Moffett wrote:
>> On Sep 13, 2006, at 01:34:01, David Wagner wrote:
>>> So it sounds like git-tar-tree has a bug; its default isn't setting
>>> meaningful permissions on the files that it puts into the tar
>>> archive.
>>> I hope the maintainers of git-tar-tree will consider fixing this
>>> bug.
>>
>> Let me reiterate: This is not a bug!
>
> I think it is a bug. It sounds like git-tar-tree is storing the
> wrong set of permissions in the tar archive.

No, git-tar-tree is storing the desired permissions (0666 and 0777)
in the tar archive. This is not a bug, those are actually the
permissions we want in the tar archive.

> When I run "tar cf foo.tar bar", and bar has permissions 0644, then
> tar inserts an entry into the archive for "bar" with its
> permissions listed as 0644 (*not* 0666).

This is irrelevant because the actual permissions copied from GIT to
the tar archive are 0666 (as desired).

> If "tar cf foo.tar bar" just ignored the permissions on bar and
> always used a default of 0666 out of laziness, that would be a bug
> in "tar cf". The same goes for git-tar-tree. It seems to me that
> git-tar-tree ought to behave the same as "tar cf".

It does; except the permissions in git are 0666 for files and 0777
for directories so that your umask takes effect when you check out
from GIT or extract a tar archive exported from GIT.

> In any case, regardless of whether this is by design or not, it is
> not courteous to your users to distribute tar files where all the
> files have permissions 0666. That's not a user-friendly to do.

No, it is user-friendly. This is like distributing programs who use
open(..., 0666) when opening globally-readable files. Programs that
use open(..., 0644) are considered uncourteous because they
intentionally ignore your umask. The only cases where that is
acceptable is user SSH private key files. Likewise we store files
with permissions 0666 in the tar archive so that the user's umask is
applied to them properly.

o Do *not* extract kernel trees as root
o Do *not* build kernel trees as root
o Do *not* package kernel trees as root
o Do install kernel packages as root

It's that simple. Please drop this discussion as it was brought up
repeatedly on this list and the fairly general consensus is that this
is not a bug in either the kernel source trees or GIT.

Cheers,
Kyle Moffett

2006-09-13 11:08:31

by Martin Mares

[permalink] [raw]
Subject: Re: R: Linux kernel source archive vulnerable

Hello!

> In any case, regardless of whether this is by design or not, it is not
> courteous to your users to distribute tar files where all the files have
> permissions 0666. That's not a user-friendly to do.

I disagree.

(1) Some systems use per-user groups and create all files group-writeable
by default, i.e., they set the umask to 002. If you want to be user-friendly,
you should respect this setting, so the permissions in the tar archives you
distribute should be 666.

(2) People extracting random archives as root with preserving permissions
(and owners) are relying on *ALL* archive creators using what they suppose
are the right permissions, which is at least simple-minded, if not completely
silly. If you want to help such users, you should do so by helping them
understand they do a wrong thing and not by hiding the problem in a single
specific case.

Have a nice fortnight
--
Martin `MJ' Mares <[email protected]> http://atrey.karlin.mff.cuni.cz/~mj/
Faculty of Math and Physics, Charles University, Prague, Czech Rep., Earth
First law of socio-genetics: Celibacy is not hereditary.

2006-09-13 11:14:28

by Jan Engelhardt

[permalink] [raw]
Subject: Re: R: Linux kernel source archive vulnerable


>> In any case, regardless of whether this is by design or not, it is not
>> courteous to your users to distribute tar files where all the files have
>> permissions 0666. That's not a user-friendly to do.
>
>I disagree.
>
>(1) Some systems use per-user groups and create all files group-writeable
>by default, i.e., they set the umask to 002. If you want to be user-friendly,
>you should respect this setting, so the permissions in the tar archives you
>distribute should be 666.
>
>(2) People extracting random archives as root with preserving permissions
>(and owners) are relying on *ALL* archive creators using what they suppose
>are the right permissions, which is at least simple-minded, if not completely
>silly. If you want to help such users, you should do so by helping them
>understand they do a wrong thing and not by hiding the problem in a single
>specific case.

And for those who -- for whatever reason -- extract kernelballs as root,
should go use --no-same-permission.


Jan Engelhardt
--