NetBSD Problem Report #52480

From www@NetBSD.org  Thu Aug 10 20:47:45 2017
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 2B4587A200
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 10 Aug 2017 20:47:45 +0000 (UTC)
Message-Id: <20170810204744.2C3337A277@mollari.NetBSD.org>
Date: Thu, 10 Aug 2017 20:47:44 +0000 (UTC)
From: jdbaker@mylinuxisp.com
Reply-To: jdbaker@mylinuxisp.com
To: gnats-bugs@NetBSD.org
Subject: /bin/ksh HISTFILE created with default mode for directories, not files
X-Send-Pr-Version: www-1.0

>Number:         52480
>Category:       bin
>Synopsis:       /bin/ksh HISTFILE created with default mode for directories, not files
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Aug 10 20:50:00 +0000 2017
>Closed-Date:    Wed Jan 17 00:29:43 +0000 2018
>Last-Modified:  Tue Mar 13 17:05:02 +0000 2018
>Originator:     John D. Baker
>Release:        NetBSD/amd64-7.1_STABLE (and probably earlier)
>Organization:
>Environment:
NetBSD spike.technoskunk.fur 7.1_STABLE NetBSD 7.1_STABLE (SPIKE) #10: Fri Jul 14 16:58:38 CDT 2017  sysop@yggdrasil.technoskunk.fur:/r0/build/netbsd-7/obj/amd64/sys/arch/amd64/compile/SPIKE amd64

>Description:
If one sets the HISTFILE variable to define a file from/to which
'/bin/ksh' is to read/save history and the file does not yet exist,
it will be created with mode 777^umask when 'ksh' first saves
command history.

This would appear to be using the default mode used for creating
a directory (777), subject to the user's "umask" value.

No ordinary file should have execute mode by default.  Unless there's
reason for a different value, mode 600 is more appropriate.
>How-To-Repeat:
  $ ls -la $HOME/foo_history
  ls: /home/jdbaker/foo_history: No such file or directory
  $ umask
  002
  $ ksh
  $ HISTFILE=$HOME/foo_history
  $ exit
  $ ls -la $HOME/foo_history
  -rwxrwxr-x  1 jdbaker  jdbaker  10697 Aug 10 15:33 /home/jdbaker/foo_history*
>Fix:
Workaround:

  $ chmod 600 $HISTFILE

after the first time 'ksh' saves history.

>Release-Note:

>Audit-Trail:

State-Changed-From-To: open->closed
State-Changed-By: maya@NetBSD.org
State-Changed-When: Wed, 17 Jan 2018 00:29:43 +0000
State-Changed-Why:
Applied, thanks!


From: "Maya Rashish" <maya@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/52480 CVS commit: src/bin/ksh
Date: Wed, 17 Jan 2018 00:29:23 +0000

 Module Name:	src
 Committed By:	maya
 Date:		Wed Jan 17 00:29:22 UTC 2018

 Modified Files:
 	src/bin/ksh: history.c

 Log Message:
 Use 0600 as the mode for histfile here too.

 pointed out by John D. Baker in PR bin/52480


 To generate a diff of this commit:
 cvs rdiff -u -r1.17 -r1.18 src/bin/ksh/history.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "John D. Baker" <jdbaker@mylinuxisp.com>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: bin/52480 (/bin/ksh HISTFILE created with default mode for
 directories, not files)
Date: Tue, 16 Jan 2018 19:20:58 -0600 (CST)

 On Wed, 17 Jan 2018, maya@NetBSD.org wrote:

 > State-Changed-From-To: open->closed
 > State-Changed-By: maya@NetBSD.org
 > State-Changed-When: Wed, 17 Jan 2018 00:29:43 +0000
 > State-Changed-Why:
 > Applied, thanks!

 I consider this something of a security issue and should be pulled up to
 all active branches.

 -- 
 |/"\ John D. Baker, KN5UKS               NetBSD     Darwin/MacOS X
 |\ / jdbaker[snail]mylinuxisp[flyspeck]com    OpenBSD            FreeBSD
 | X  No HTML/proprietary data in email.   BSD just sits there and works!
 |/ \ GPGkeyID:  D703 4A7E 479F 63F8 D3F4  BD99 9572 8F23 E4AD 1645

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/52480 CVS commit: [netbsd-8] src/bin/ksh
Date: Mon, 22 Jan 2018 12:13:15 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Mon Jan 22 12:13:15 UTC 2018

 Modified Files:
 	src/bin/ksh [netbsd-8]: history.c

 Log Message:
 Pull up following revision(s) (requested by maya in ticket #505):
 	bin/ksh/history.c: revision 1.18
 Use 0600 as the mode for histfile here too.
 pointed out by John D. Baker in PR bin/52480


 To generate a diff of this commit:
 cvs rdiff -u -r1.12 -r1.12.6.1 src/bin/ksh/history.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Soren Jacobsen" <snj@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/52480 CVS commit: [netbsd-7-0] src/bin/ksh
Date: Mon, 22 Jan 2018 19:57:17 +0000

 Module Name:	src
 Committed By:	snj
 Date:		Mon Jan 22 19:57:17 UTC 2018

 Modified Files:
 	src/bin/ksh [netbsd-7-0]: history.c

 Log Message:
 Pull up following revision(s) (requested by maya in ticket #1554):
 	bin/ksh/history.c: revision 1.18 via patch
 Use 0600 as the mode for histfile here too.
 pointed out by John D. Baker in PR bin/52480


 To generate a diff of this commit:
 cvs rdiff -u -r1.11 -r1.11.24.1 src/bin/ksh/history.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Soren Jacobsen" <snj@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/52480 CVS commit: [netbsd-7-1] src/bin/ksh
Date: Mon, 22 Jan 2018 19:58:38 +0000

 Module Name:	src
 Committed By:	snj
 Date:		Mon Jan 22 19:58:38 UTC 2018

 Modified Files:
 	src/bin/ksh [netbsd-7-1]: history.c

 Log Message:
 Pull up following revision(s) (requested by maya in ticket #1554):
 	bin/ksh/history.c: revision 1.18 via patch
 Use 0600 as the mode for histfile here too.
 pointed out by John D. Baker in PR bin/52480


 To generate a diff of this commit:
 cvs rdiff -u -r1.11 -r1.11.30.1 src/bin/ksh/history.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Soren Jacobsen" <snj@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/52480 CVS commit: [netbsd-7] src/bin/ksh
Date: Mon, 22 Jan 2018 19:59:06 +0000

 Module Name:	src
 Committed By:	snj
 Date:		Mon Jan 22 19:59:06 UTC 2018

 Modified Files:
 	src/bin/ksh [netbsd-7]: history.c

 Log Message:
 Pull up following revision(s) (requested by maya in ticket #1554):
 	bin/ksh/history.c: revision 1.18 via patch
 Use 0600 as the mode for histfile here too.
 pointed out by John D. Baker in PR bin/52480


 To generate a diff of this commit:
 cvs rdiff -u -r1.11 -r1.11.22.1 src/bin/ksh/history.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Soren Jacobsen" <snj@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/52480 CVS commit: [netbsd-6-0] src/bin/ksh
Date: Tue, 13 Mar 2018 17:01:54 +0000

 Module Name:	src
 Committed By:	snj
 Date:		Tue Mar 13 17:01:54 UTC 2018

 Modified Files:
 	src/bin/ksh [netbsd-6-0]: history.c

 Log Message:
 Pull up following revision(s) (requested by maya in ticket #1520):
 	bin/ksh/history.c: 1.18
 Use 0600 as the mode for histfile here too.
 pointed out by John D. Baker in PR bin/52480


 To generate a diff of this commit:
 cvs rdiff -u -r1.11 -r1.11.10.1 src/bin/ksh/history.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Soren Jacobsen" <snj@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/52480 CVS commit: [netbsd-6-1] src/bin/ksh
Date: Tue, 13 Mar 2018 17:01:56 +0000

 Module Name:	src
 Committed By:	snj
 Date:		Tue Mar 13 17:01:56 UTC 2018

 Modified Files:
 	src/bin/ksh [netbsd-6-1]: history.c

 Log Message:
 Pull up following revision(s) (requested by maya in ticket #1520):
 	bin/ksh/history.c: 1.18
 Use 0600 as the mode for histfile here too.
 pointed out by John D. Baker in PR bin/52480


 To generate a diff of this commit:
 cvs rdiff -u -r1.11 -r1.11.18.1 src/bin/ksh/history.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Soren Jacobsen" <snj@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/52480 CVS commit: [netbsd-6] src/bin/ksh
Date: Tue, 13 Mar 2018 17:01:58 +0000

 Module Name:	src
 Committed By:	snj
 Date:		Tue Mar 13 17:01:57 UTC 2018

 Modified Files:
 	src/bin/ksh [netbsd-6]: history.c

 Log Message:
 Pull up following revision(s) (requested by maya in ticket #1520):
 	bin/ksh/history.c: 1.18
 Use 0600 as the mode for histfile here too.
 pointed out by John D. Baker in PR bin/52480


 To generate a diff of this commit:
 cvs rdiff -u -r1.11 -r1.11.4.1 src/bin/ksh/history.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search