tech-pkg archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: www/serf install permissions fix



On 03/31, Edgar Fuß wrote:
> > Fix permissions after extraction (but, as you pointed out, there
> > is the security issue with the window of group- and world-writable
> > before the fix-up)?
>
> You could make the work directory temporaribly
> non-{group,world}-searchable.

Good point.  One potential pitfall would be that the work directory
might be left in that state if an error occurs during the extraction
or fix-up such that the work directory is not restored to
{group,world}-searchable.  Is that acceptable?

Is this the preferred solution?  Would someone like to implement the
change?  If not, I could implement it, but I don't want to spend time
doing it if someone else is going to do it or if it's not really the
preferred solution.

Thanks,

Lewis


Home | Main Index | Thread Index | Old Index