GNU bug report logs - #29182
CVE-2017-1000383: umask and backup files

Previous Next

Full log

View this message in rfc822 format

From: Glenn Morris <rgm <at> gnu.org>
To: 29182 <at> debbugs.gnu.org
Subject: bug#29182: CVE-2017-1000383: umask and backup files
Date: Mon, 06 Nov 2017 20:57:26 -0500

I think the actual complaint appears at http://seclists.org/oss-sec/2017/q4/159
and could be summarized as "if you create a file, then make your umask
more restrictive, then edit it with Emacs, the backup file inherits the
same permissions as the original file, not the more restrictive umask
permissions".

Eg:
umask 002
touch foo
ls -l foo #   -> -rw-rw-r--
umask 007
emacs-25.3 -Q foo
 make some changes and save
touch foo2
ls -l foo*
 foo  -rw-rw-r--.
 foo~ -rw-rw-r--.
 foo2 -rw-rw----.

(With backup-by-copying non-nil, the result is the same.)

I don't really know what my opinion of this issue is...
I imagine I would have made the same reply as
http://seclists.org/oss-sec/2017/q4/184

 [Emacs] copies the permission from the file being edited. Although the
 [backup] file is readable by others this does not leak any information
 here, since the file being edited is already readable by others.

but this is dismissed with:

  ...it doesn't matter because a security assertion made via umask is
  being violated, so it wins a CVE. Also for example if you later delete
  that file and think you're safe the copy is still floating around
  world readable. Or you have something indexing the files and ignoring
  that file type, and the [~] gets indexed, and so on.

Anyway, you can probably find every shade of opinion on what to do about
this already expressed in that oss-sec thread or the related vim one.

I think I've found it useful many, many times that ~ files have the same
permissions as the originals.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.