bugGNU Wget - Bugs: bug #57766, Remove group-write permission from...

 
 

bug #57766: Remove group-write permission from ~/.wget-hsts file

Submitter:  Jon Beilke <jrbeilke>
Submitted:  Fri 07 Feb 2020 05:16:09 PM UTC
   
 
Category:  Feature Request Severity:  3 - Normal
Priority:  5 - Normal Status:  Invalid
Privacy:  Public Assigned to:  rockdaboot
Originator Name:  Open/Closed:  Closed
Release:  trunk Operating System:  GNU/Linux
Reproducibility:  Every Time Fixed Release:  None
Planned Release:  None Regression:  None
Work Required:  None Patch Included:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 07 Feb 2020 08:30:35 PM UTC, comment #3: 

Found the issue, one of our provisioning scripts was temporarily overriding the umask while setting up another service and that service was making a wget call thus generating the .wget-hsts file with the extra group write permission.

Thanks again for the umask recommendation.

Jon Beilke <jrbeilke>
Fri 07 Feb 2020 07:37:15 PM UTC, comment #2: 

Thanks Tim.

The umask is set to 027 which should leave group write permissions off the .wget-hsts file based on your comment, but I'll keep digging to make sure I'm not missing anything.

$ umask
0027

Jon Beilke <jrbeilke>
Fri 07 Feb 2020 06:31:35 PM UTC, comment #1: 

We use POSIX fopen(fname, "w"). The file permissions are masked by your umask setting.

From the man page of fopen:
       Any created file will have the mode S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH (0666), as modi‐
       fied by the process's umask value (see umask(2)).

So if you are concerned about security, the umask is the first thing to check and adjust.

Tim Ruehsen <rockdaboot>
Group administrator
Fri 07 Feb 2020 05:16:09 PM UTC, original submission:  

Working on improving the security of our Linux systems and one of the recommendations is to ensure user dot files are not group or world writable (CIS DIL 6.2.10), but wget generates the .wget-hsts file for users with group write permissions.

Here's an example from a fresh Ubuntu 18.04.4 system with wget 1.19.4:
$ ls -al
total 40
drwxr-xr-x 6 vagrant vagrant 4096 Feb  7 17:04 .
drwxr-xr-x 4 root    root    4096 Feb  7 17:03 ..
-rw-r--r-- 1 vagrant vagrant  220 Jan 31 15:58 .bash_logout
-rw-r--r-- 1 vagrant vagrant 3771 Jan 31 15:58 .bashrc
drwx------ 2 vagrant vagrant 4096 Feb  7 17:03 .cache
drwx------ 3 vagrant vagrant 4096 Feb  7 17:03 .gnupg
-rw-r--r-- 1 vagrant vagrant  807 Jan 31 15:58 .profile
drwx------ 2 vagrant vagrant 4096 Feb  7 17:03 .ssh
-rw-rw-r-- 1 vagrant vagrant  165 Feb  7 17:04 .wget-hsts

Is there a specific wget feature/functionality that requires the .wget-hsts file be writable by the group?

If not can the file be generated with 644 permissions instead?

Jon Beilke <jrbeilke>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rockdaboot (Posted a comment)
  • -email is unavailable- added by jrbeilke (Submitted the item)
  •  

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-02-07 rockdaboot StatusNone Invalid
        Assigned toNone rockdaboot
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code