Say I'm implementing a programming language which has an interactive mode, and that interactive mode reads some ~/.foo_rc file in the user's home directory. The file contains code in that language which can be used to customize some preferences. The language isn't sandboxed when reading this file; the file can do "anything".
Should I bother doing a permission check on the file? Like:
$ foo -i
Not reading ~/.foo_rc because it is world-writable, you goof!
P.S. you don't even own it; someone else put it there.
> _
I'm looking at the Bash source and it doesn't bother with permission checks for ~/.bash_profile (other than that it exists and is readable, preconditions for doing anything with it at all).
[Update]
After considering thrig's answer, I implemented the following check on the file:
If the file is not owned by the effective user ID of the caller, then it is not secure.
If the file is writable to others, then it is not secure.
If the file is writable to the owning group, then it is not secure if the group includes users other than caller. (I.e. the group must either be empty, or have the caller as its one and only member).
Otherwise it is deemed secure.
Note that the group check makes no assumptions about any correspondence between numeric user ID's and group ID's, or their names; it is based on checking that the name of the user is listed as the sole member.
(A note is added to the documentation for the function which performs this check that it's subject to a time-of-check to time-of-use race condition. After the check is applied, an innocent superuser can extend the group with additional members, who may be malicious, and modify the file by the time it is accessed.)
