Development record
abcd creates its home folder ~/.abcd with different permissions depending on which command creates it first: the credential store makes it private to the account (0o700), while ahoy's history store and owned copy make it readable by other accounts on the computer (0o755). On a Mac shared by several accounts, whichever runs first decides whether others can list abcd's home. Found by the dashboard design's security review.
issueresolvedminoriss-2610032205304585
abcd creates its home folder ~/.abcd with different permissions depending on which command creates it first: the credential store makes it private to the account (0o700), while ahoy's history store and owned copy make it readable by other accounts on the computer (0o755). On a Mac shared by several accounts, whichever runs first decides whether others can list abcd's home. Found by the dashboard design's security review.
Grounds
- pursued: TestEveryHomeWriterMakesTheHomePrivate holds every home-creating call (14 judged) to abcdhome.DirMode with an armed twin, TestHomeWritersMakeTheHomePrivate and TestBootstrapMakesTheHomePrivate assert 0700/0600 on a fresh home, TestAnEarlierIndexIsNarrowedAtItsNextWrite the narrowing; a home created 0755 by any command first, or a record left 0644 after its rewrite, would show it wrong. Two security reviews (Fable) closed every finding.
Frontmatter
| id | iss-2610032205304585 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2610032205304585-abcd-creates-its-home-folder-abcd-with.md
open on GitHub ↗ · commit history ↗
mentions1
- dcn-26100400000000072026-10-04 — Decided without a question by abcd-50 (one defensible answer), on the security review of the home-mode fix (iss-2610032205304585): an existing abcd home keeps the mode it has, because every home-scope writer's contract is that a level which already exists keeps its mode (fsutil.EnsureHomeScope, fsutil.EnsureRealDir) and re-moding a folder on the person's machine is a change the issue did not ask for; the two records an earlier version wrote 0o644 (the path-entry record and the registry's index) are narrowed to 0o600 at their next write instead (the bootstrap re-stamps path-entry at every provision, the registry rewrites its index at every registration), so on an existing 0o755 home the residual is that other accounts can list the folder's names, never read a record abcd keeps there. Not chosen: chmod an existing home to 0o700 when the account owns it.