0

On the Linux systems I've seen the files .profile and .bash_profile in ~ have permissions -rw-r--r--.

People seem to put various env vars into these files quite often, including smth like AWS keys, etc.

Those non-owner R bits don't make these files widely readable, because home directories themselves prevent that by having drwx------. Which makes sense.

HOWEVER.

Doesn't this increase the potential attack surface? What's the reason for having those R bits on by default across many Linux distributions? Any specific use-cases valid today?

Btw, .bash_history has -rw-------. So it looks more private than the files in subject. Not clear why.

5
  • It sounds as if you may be a disciple of Lennart Poettering? I say this because of the proposed additions (homectl & systemd-homed) to systemd. I don't know about the attack surface, but it does seem that there might be some privacy risks?
    – Seamus
    Nov 29, 2023 at 1:17
  • 2
    Probably just because they were copied from a template which was owned by a different user and/or with default umask. Keys shouldn't be in there anyway, there's a reason why ~/.ssh is not world-readable
    – Useless
    Nov 29, 2023 at 1:30
  • 1
    @Useless The reason ~/.ssh is not world readable is that the developers of SSH care about security more than shell and distro people, that's all.
    – Kaz
    Nov 29, 2023 at 6:13
  • Yes, developers of ssh care more because ssh needs security. shell barely does.
    – user10489
    Nov 29, 2023 at 6:35
  • @Seamus Could you unfold "some privacy risks" into specific samples?
    – Anton K
    Nov 29, 2023 at 12:54

2 Answers 2

2

First, the default profile files do not contain passwords and typically the information in these files is not sensitive, and it is rare for sensitive information to go in them and they typically don't change much. If you are going to put sensitive things in them, you can change the permissions at that time. It would be better to put sensitive information in a separate file and source that from the profile files. On the other hand, .bash_history can contain extensive private information, including recent activities.

Secondly, environment variables are world readable anyway using the ps command, so it is insecure to put sensitive information in environment variables anyway, so putting environment settings in .bashrc and then making it world readable doesn't make things significantly less secure since environment variables are already world readable.

2
  • What? /proc/<pid>/environ is not accessible if the process is not yours and you are not root!
    – Kaz
    Nov 29, 2023 at 6:12
  • Could you explain how exactly "environment variables are world readable ... using the ps command"?
    – Anton K
    Nov 29, 2023 at 12:39
0

That is wrong; they shouldn't be readable. They could contain sensitive information like environment variable definitions with API keys and whatnot.

In the TXR Language, I did something about this. If you start an interactive session, it checks the permissions of the startup files, and diagnoses.

$ ls -l ~/.txr_profile
-rw-r----- 1 kaz kaz 775 Aug  2  2021 /home/kaz/.txr_profile
$ txr
This is the TXR Lisp interactive listener of TXR 292.
Quit with :quit or Ctrl-D on an empty line. Ctrl-X ? for cheatsheet.
Merry GNUsmas, dear FSF friends! ... Crap, wait. That's 'Samsung' backwards!
1>
$ chmod go+r ~/.txr_profile
$ txr
This is the TXR Lisp interactive listener of TXR 292.
Quit with :quit or Ctrl-D on an empty line. Ctrl-X ? for cheatsheet.
** security problem: /home/kaz/.txr_profile is readable by others
1>

Note that it didn't execute the profile file (and so we don't see the random quote). If you create a profile file with the wrong permissions, whatever you put into it won't run: to get it working, you will have to fix the perms.

Bash history is private because Bash creates that file, not your distro, and Bash uses the right creation mask.

However, if I change ~/.bash_history to rw-r--r--, or even rw-rw-rw-, and fire up a new Bash instance, I don't see any warning. Whoops!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .