lkml.org 
[lkml]   [2006]   [Sep]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: R: Linux kernel source archive vulnerable
    Date
    Kyle Moffett  wrote:
    >No, git-tar-tree is storing the desired permissions (0666 and 0777)
    >in the tar archive. This is not a bug, those are actually the
    >permissions we want in the tar archive.

    Those may be the permissions *you* want, but they're not the permissions
    I suspect many users would prefer. Take a look at any open-source
    project that ships tar archives of their source code. Do they ship
    tarballs of their source code where all the files have 0666 permissions?
    Not in my experience. That should tell you something.

    Telling me that this is "by design" is not a very persuasive response
    when my claim is that the design is poorly chosen.

    >No, it is user-friendly. This is like distributing programs who use
    >open(..., 0666) when opening globally-readable files.

    It's not the same. There's a reason that most other open-source
    projects are careful not to distribute 0666 files in their tar archives.

    >o Do *not* extract kernel trees as root

    I don't see anything unreasonable about extracting tarballs from a
    trusted source as root (unless, of course, the folks who put together
    the tarballs are malicious or careless or can't be trusted).

    I don't see any good justification for this other than that the
    maintainers of git-tar-tree can't be bothered to store more reasonable
    permissions in the tar archive. It smells like a workaround that is
    designed to make the lives of the git-tar-tree programmers easier --
    but at the cost of making users lives a little harder. That's what I
    mean when I said that this decision doesn't seem very user-friendly.
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-09-13 09:03    [W:0.026 / U:92.068 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site