Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set stricter directory permissions #85

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Set stricter directory permissions #85

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
52b6717
top level directory with lesser permissions and preserve unix file mode
vu3rdd Jul 19, 2022
a254397
make top level directory accessible only for the owner
vu3rdd Jul 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions cmd/recv.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ func recvAction(cmd *cobra.Command, args []string) {
msg.Reject()
bail("transfer rejected")
} else {
err = os.Mkdir(msg.Name, 0777)
err = os.Mkdir(msg.Name, 0700)
if err != nil {
bail("Mkdir error for %s: %s\n", msg.Name, err)
}
Expand Down Expand Up @@ -215,7 +215,7 @@ func recvAction(cmd *cobra.Command, args []string) {
}

dir := filepath.Dir(p)
err = os.MkdirAll(dir, 0777)
err = os.MkdirAll(dir, 0700)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gosec suggests 0750 as that means read/write/execute for user and read/execute for group and no permissions for other. I think that might make more sense.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason for choosing 0700 was that since this is a program that is a very privacy oriented file transfer program, it would be prudent choose a more "paranoid" default. For instance, if a recipient got very sensitive files and didn't want another user to access it. As a program, we guarantee such a behaviour instead of relying on the operating system.

Copy link
Contributor

@Jacalz Jacalz Aug 26, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know but I think 0700 is too strict given that it doesn't include group permissions. Using 0750 will be almost just as good but without potential permission issues.

if err != nil {
bail("Failed to mkdirall %s: %s", dir, err)
}
Expand All @@ -224,6 +224,11 @@ func recvAction(cmd *cobra.Command, args []string) {
if err != nil {
bail("Failed to open %s: %s", p, err)
}
mode := zf.Mode()
err = os.Chmod(p, mode)
if err != nil {
bail("error setting mode for %s: %s", p, err)
}

_, err = io.Copy(f, rc)
if err != nil {
Expand Down