Re: CVE request: psi+ stores the cache file as world-readable

[Russ Allbery <rra () stanford edu>]

gremlin () gremlin ru writes:
> On 26-Feb-2013 23:04:24 +0100, Agostino Sarubbo wrote:

>  > Psi+, a fork of psi, stores its files in ~/.cache/psi+ as
>  > world-readable.

> That's normal - users' home directories are normally accessible
> only by users themselves, and never by othe users:

> gremlin@hren:~ > ls -ld .
> drwx-----x 47 gremlin users 20480 2013-02-26 17:48 ./

That is one possible convention of many for structuring user home
directory permissions.  It is certainly not universal, and no software
should assume that home directory permissions are structured that way when
deciding on the permissions of other files created under the user's home
directory.

Some of us who have been using UNIX for long enough that we originally
learned the permissions system when sharing was emphasized over security
do still use world-readable home directories, with specific directories
under it restricted.  We would like software, when creating private files,
to not assume that it can be careless about permissions of individual
files because "of course" the user's home directory is private.

-- 
Russ Allbery (rra () stanford edu)             <http://www.eyrie.org/~eagle/>