[#40602] [ruby-trunk - Bug #5532][Open] Compile problem for bigdecimal on cygwin — Martin Dürst <duerst@...>

14 messages 2011/11/01

[#40617] [ruby-trunk - Feature #5534][Open] Redefine Range class and introduce RelativeNumeric and RelativeRange — Alexey Muranov <muranov@...>

17 messages 2011/11/01

[#40646] [ruby-trunk - Bug #5541][Open] Better configure error message when llvm-gcc is the default compiler — Eric Hodel <drbrain@...7.net>

10 messages 2011/11/01

[#40648] [ruby-trunk - Feature #5543][Open] rb_thread_blocking_region() API is poorly designed — Christopher Huff <cjameshuff@...>

14 messages 2011/11/01

[#40684] [ruby-trunk - Feature #5555][Open] rename #include? to #includes? — Alexey Muranov <muranov@...>

20 messages 2011/11/02

[#40688] [ruby-trunk - Bug #5556][Open] SIGHUP no longer ignored when sent to process group from a subprocess — Brian Ford <brixen@...>

12 messages 2011/11/02

[#40706] [ruby-trunk - Feature #5562][Open] Improvement of Windows IO performance — Hiroshi Shirosaki <h.shirosaki@...>

39 messages 2011/11/03

[#40737] [ruby-trunk - Bug #5570][Open] Encoding of environment variables on Windows — Nikolai Weibull <now@...>

11 messages 2011/11/04

[#40748] Proposal for sustainable branch maintenance — "Yuki Sonoda (Yugui)" <yugui@...>

-----BEGIN PGP SIGNED MESSAGE-----

14 messages 2011/11/05

[#40770] [ruby-trunk - Feature #5578][Open] Embedded YAML for Ruby 2.0 — Thomas Sawyer <transfire@...>

17 messages 2011/11/06

[#40806] [ruby-trunk - Feature #5583][Open] Optionally typing — Yasushi ANDO <andyjpn@...>

21 messages 2011/11/07

[#40824] [ruby-trunk - Feature #5588][Open] add negation flag (v) to Regexp — Suraj Kurapati <sunaku@...>

38 messages 2011/11/08

[#40865] IO.copy_stream creates files with restrictive permissions — Eric Wong <normalperson@...>

I'm not sure if this is a bug or intended as spec.

16 messages 2011/11/09
[#41151] Re: IO.copy_stream creates files with restrictive permissions — Tanaka Akira <akr@...> 2011/11/19

2011/11/9 Eric Wong <normalperson@yhbt.net>:

[#41166] Re: IO.copy_stream creates files with restrictive permissions — KOSAKI Motohiro <kosaki.motohiro@...> 2011/11/20

>> I noticed when a file name argument is passed to the IO.copy_stream, the

[#41168] Re: IO.copy_stream creates files with restrictive permissions — Clifford Heath <clifford.heath@...> 2011/11/20

On 20/11/2011, at 5:09 PM, KOSAKI Motohiro wrote:

[#41176] Re: IO.copy_stream creates files with restrictive permissions — Tanaka Akira <akr@...> 2011/11/21

2011/11/20 Clifford Heath <clifford.heath@gmail.com>:

[#41180] Re: IO.copy_stream creates files with restrictive permissions — KOSAKI Motohiro <kosaki.motohiro@...> 2011/11/21

>> I think documentation is the wrong answer. The security defects are not caused

[#40908] [ruby-trunk - Feature #5607][Open] Inconsistent reaction in Range of String — Yen-Nan Lin <redmine@...>

15 messages 2011/11/10

[#40941] [ruby-trunk - Feature #5617][Open] Allow install RubyGems into dediceted directory — Vit Ondruch <v.ondruch@...>

22 messages 2011/11/11

[#40951] [Backport93 - Backport #5621][Open] Please backport thread-safe autoloading patch — Mike Perham <mperham@...>

25 messages 2011/11/12
[#40971] [Backport93 - Backport #5621] Please backport thread-safe autoloading patch — Mike Perham <mperham@...> 2011/11/12

[#40972] Re: [Backport93 - Backport #5621] Please backport thread-safe autoloading patch — Yehuda Katz <wycats@...> 2011/11/12

Unfortunately ruby-head has a deadlock in one of my go-to scenarios for

[#40976] Re: [Backport93 - Backport #5621] Please backport thread-safe autoloading patch — Hiroshi Nakamura <nahi@...> 2011/11/13

-----BEGIN PGP SIGNED MESSAGE-----

[#41128] Re: [Backport93 - Backport #5621] Please backport thread-safe autoloading patch — Charles Oliver Nutter <headius@...> 2011/11/18

On Sat, Nov 12, 2011 at 7:24 PM, Hiroshi Nakamura <nahi@ruby-lang.org> wrote:

[#41129] Re: [Backport93 - Backport #5621] Please backport thread-safe autoloading patch — Hiroshi Nakamura <nahi@...> 2011/11/18

-----BEGIN PGP SIGNED MESSAGE-----

[#41142] Re: [Backport93 - Backport #5621] Please backport thread-safe autoloading patch — Charles Oliver Nutter <headius@...> 2011/11/18

On Fri, Nov 18, 2011 at 12:15 AM, Hiroshi Nakamura <nahi@ruby-lang.org> wrote:

[#40982] [ruby-trunk - Bug #5625][Open] Remove profanity and pejoratives — Andrew Grimm <andrew.j.grimm@...>

30 messages 2011/11/13

[#41004] [ruby-trunk - Feature #5628][Open] Module#basename — Thomas Sawyer <transfire@...>

18 messages 2011/11/14

[#41024] [ruby-trunk - Feature #5632][Open] Attempt to open included class shades it instead. — Boris Stitnicky <boris@...>

12 messages 2011/11/14

[#41025] Proposal to add new methods: positive? negative? natural? — JosFrancisco Calvo Moreno <josefranciscocalvo@...>

Hi all!

11 messages 2011/11/14
[#41027] Re: Proposal to add new methods: positive? negative? natural? — Jeremy Evans <code@...> 2011/11/14

On 11/15 12:58, Jos? Francisco Calvo Moreno wrote:

[#41031] Re: Proposal to add new methods: positive? negative? natural? — JosFrancisco Calvo Moreno <josefranciscocalvo@...> 2011/11/14

Hi Jeremy,

[#41038] [ruby-trunk - Bug #5634][Open] yield and binding — Thomas Sawyer <transfire@...>

17 messages 2011/11/14

[#41086] [ruby-trunk - Feature #5644][Open] add Enumerable#exclude? antonym — Suraj Kurapati <sunaku@...>

14 messages 2011/11/17

[#41175] [ruby-trunk - Feature #5654][Open] Introduce global lock to avoid concurrent require — Hiroshi Nakamura <nakahiro@...>

12 messages 2011/11/21

[#41200] [ruby-trunk - Bug #5659][Open] bug releasing a gem created with rails 3.1 — Vinicius Gati <viniciusgati@...>

14 messages 2011/11/22

[#41212] [ruby-trunk - Feature #5662][Open] inject-accumulate, or Haskell's mapAccum* — Edvard Majakari <edvard.majakari@...>

12 messages 2011/11/22

[#41213] [ruby-trunk - Bug #5663][Open] Combined map/select method — Yehuda Katz <wycats@...>

62 messages 2011/11/22

[#41317] [ruby-trunk - Bug #5676][Open] miniruby linking error: undefined reference to ___stack_chk_guard — Martin Dürst <duerst@...>

10 messages 2011/11/27

[#41404] [ruby-trunk - Bug #5690][Open] Module#qualified_const_get — Yehuda Katz <wycats@...>

31 messages 2011/11/30

[ruby-core:41168] Re: IO.copy_stream creates files with restrictive permissions

From: Clifford Heath <clifford.heath@...>
Date: 2011-11-20 06:34:37 UTC
List: ruby-core #41168
On 20/11/2011, at 5:09 PM, KOSAKI Motohiro wrote:
>>> I noticed when a file name argument is passed to the IO.copy_stream, the
>>> newly-created destination file has 0600 perms and is not respecting my
>>> normal umask (0022).
>> 
>> Sometimes the convention, 0666 by default, causes security problem:
>> It causes world writable files if users forget to set correct umask.
>> 
>> There are various umask related security problem:
>> CVE-1999-1572, CVE-2001-1322, CVE-2005-1841, CVE-2006-1587,
>> CVE-2006-3589, CVE-2007-6249
>> 
>> So I didn't use 0666.
>> 
>> 0600 may be too restrictive but you can use File.chmod to relax it.
> 
> If you don't follow normal convention intentionally, is there any
> reason to don't write a documentation explicitly?

I think documentation is the wrong answer. The security defects are not caused
by programs using mode 0666 - which they should do by default - but by the
user having set their umask incorrectly. Ruby should not attempt to prevent this
user error. There are situations where it's legal to create a file, but because of
setuid mode on the directory, it's not possible for the program to chmod the new
file. This problem can only be avoided by using the correct mode at creation.

If you feel that Ruby *must* do something to address the umask problem, then
please consider whether Ruby should save the startup umask into a global constant
before changing for a more restrictive setting. This allows the programmer to set
umask back and avoid the "nanny state" setting.

Still, I don't favour this anyway. To attempt to prevent programmers from creating
insecure programs by restricting functionality is a hopeless quest.

Clifford Heath.

In This Thread