Re: Re: CVE request(?): gpg: improper file permssions set when en/de-crypting files

[Michael Gilbert <mgilbert () debian org>]

On Fri, Sep 21, 2012 at 3:30 PM, Kurt Seifried
> > Think about it this way.  I open a file with mode 600 in vim, edit
> > it, save it, and find it with mode 644?  That would be an exposure,
> > would it not?
>
> Not if it respects your umask.

Editing does not invoke a umask because the program already knows what
umask you really wanted for that file, and didn't need a default to
guess at it.

$ umask
0077
$ touch test
$ ls -l test
-rw------- 1 a a 5 Sep 21 17:09 test
$ umask 022
$ echo test > test
$ ls -l test
-rw------- 1 a a 5 Sep 21 17:09 test

> If you want privacy set your umask
> correctly. Programs can't know what they're supposed to do unless you
> tell them. And we tell the system using umask.

Sure, umask applies a default set of permissions to new files, and the
process of decrypting a file with gpg certainly creates a new file.
But in this case, we can be more intelligent than the umask because we
know the permissions of the original encrypted file, and don't need to
guess at them using the umask.

> I'm confused. It's not exposed unless you configure umask wrong and
> run this in a public viewable directory. If you want a CVE for every
> single program that doesn't ensure it's (potentially sensitive) output
> is mode 0600 than that's basically, well, all the programs on a system.

So, the point is that umask is more meant more as a fallback only when
there isn't better info available to make the right permissions
decision.

Best wishes,
Mike