0

Say I'm implementing a programming language which has an interactive mode, and that interactive mode reads some ~/.foo_rc file in the user's home directory. The file contains code in that language which can be used to customize some preferences. The language isn't sandboxed when reading this file; the file can do "anything".

Should I bother doing a permission check on the file? Like:

$ foo -i
Not reading ~/.foo_rc because it is world-writable, you goof!
P.S. you don't even own it; someone else put it there.
> _

I'm looking at the Bash source and it doesn't bother with permission checks for ~/.bash_profile (other than that it exists and is readable, preconditions for doing anything with it at all).

[Update]

After considering thrig's answer, I implemented the following check on the file:

  • If the file is not owned by the effective user ID of the caller, then it is not secure.

  • If the file is writable to others, then it is not secure.

  • If the file is writable to the owning group, then it is not secure if the group includes users other than caller. (I.e. the group must either be empty, or have the caller as its one and only member).

  • Otherwise it is deemed secure.

Note that the group check makes no assumptions about any correspondence between numeric user ID's and group ID's, or their names; it is based on checking that the name of the user is listed as the sole member.

(A note is added to the documentation for the function which performs this check that it's subject to a time-of-check to time-of-use race condition. After the check is applied, an innocent superuser can extend the group with additional members, who may be malicious, and modify the file by the time it is accessed.)

3

Reasonable and prudent, provided there are clear warnings on what file is failing, and why, so the user can fix the permissions issue. bash probably dates from a more trusting (and prank-ridden) day. Note that user files can legitimately be group writable, if the site has a policy of each user going into a group that only that user is in, otherwise not.

(Parent directory checks may also be prudent, to detect chmod 777 $HOME goofs.)

  • What's a reasonable way to implement the condition for the "writable group okay" check? Just a numeric UID == GID? (Groups numerically equivalent to user ID's are assumed to be one-member groups for that user.) Or should we also retrieve the group names; i.e. verify that strcmp(getpwnam(UID), getgrname(GID)) == 0: the group is okay if it is numerically and textually the same as the UID. – Kaz Sep 17 '15 at 19:15
  • A simpler approach would be a groupwritabledirsaretotallycool boolean and then disable group checks if that is set, so if a site or user wants g+w, they can set that boolean. Delving down into the particulars of group membership gets complicated. – thrig Sep 17 '15 at 21:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.