Uploaded image for project: 'CernVM'
  1. CernVM
  2. CVM-660

Repository files should not be other-writable

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Critical
    • CernVM-FS 2.1.20
    • CernVM-FS 2.1.20
    • CVMFS
    • None

    Description

      All the files created by cvmfs_swissknife in hosted repositories and replicas are mode 666, that is, writable by "other". It's not a big security problem because if files are tampered with they will not be able to be distributed due to all the secure hashes and signatures, but still, it shouldn't be that way. It is a potential denial of service if one repository administrator tampered with files of another one on a shared repository server.

      I tested this with recent source code from git and it is still happening.

      Attachments

        Activity

          People

            rmeusel Rene Meusel (Inactive)
            dwd Dave Dykstra
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: