LKML Archive on
help / color / mirror / Atom feed
From: Kyle Moffett <>
To: (David Wagner)
Subject: Re: R: Linux kernel source archive vulnerable
Date: Wed, 13 Sep 2006 02:49:45 -0400	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <ee88af$fgo$>

On Sep 13, 2006, at 02:26:23, David Wagner wrote:
> Kyle Moffett  wrote:
>> On Sep 13, 2006, at 01:34:01, David Wagner wrote:
>>> So it sounds like git-tar-tree has a bug; its default isn't setting
>>> meaningful permissions on the files that it puts into the tar  
>>> archive.
>>> I hope the maintainers of git-tar-tree will consider fixing this  
>>> bug.
>> Let me reiterate:  This is not a bug!
> I think it is a bug.  It sounds like git-tar-tree is storing the  
> wrong set of permissions in the tar archive.

No, git-tar-tree is storing the desired permissions (0666 and 0777)  
in the tar archive.  This is not a bug, those are actually the  
permissions we want in the tar archive.

> When I run "tar cf foo.tar bar", and bar has permissions 0644, then  
> tar inserts an entry into the archive for "bar" with its  
> permissions listed as 0644 (*not* 0666).

This is irrelevant because the actual permissions copied from GIT to  
the tar archive are 0666 (as desired).

> If "tar cf foo.tar bar" just ignored the permissions on bar and  
> always used a default of 0666 out of laziness, that would be a bug  
> in "tar cf". The same goes for git-tar-tree.  It seems to me that  
> git-tar-tree ought to behave the same as "tar cf".

It does; except the permissions in git are 0666 for files and 0777  
for directories so that your umask takes effect when you check out  
from GIT or extract a tar archive exported from GIT.

> In any case, regardless of whether this is by design or not, it is  
> not courteous to your users to distribute tar files where all the  
> files have permissions 0666.  That's not a user-friendly to do.

No, it is user-friendly.  This is like distributing programs who use  
open(..., 0666) when opening globally-readable files.  Programs that  
use open(..., 0644) are considered uncourteous because they  
intentionally ignore your umask.  The only cases where that is  
acceptable is user SSH private key files.  Likewise we store files  
with permissions 0666 in the tar archive so that the user's umask is  
applied to them properly.

o   Do *not* extract kernel trees as root
o   Do *not* build kernel trees as root
o   Do *not* package kernel trees as root
o   Do install kernel packages as root

It's that simple.  Please drop this discussion as it was brought up  
repeatedly on this list and the fairly general consensus is that this  
is not a bug in either the kernel source trees or GIT.

Kyle Moffett

  reply	other threads:[~2006-09-13  6:49 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <>
     [not found] ` <D432C2F98B6D1B4BAE47F2770FEFD6B612B8B7@to1mbxs02.replynet.prv>
2006-09-11 18:29   ` Jon Lewis
2006-09-12  5:06     ` Kyle Moffett
2006-09-12  5:27       ` Willy Tarreau
2006-09-12 19:42       ` R: " David Wagner
2006-09-12 20:35         ` linux-os (Dick Johnson)
2006-09-12 21:35           ` David Wagner
2006-09-12 22:56             ` Rene Scharfe
2006-09-13  1:17               ` David Wagner
2006-09-13  4:33                 ` Willy Tarreau
2006-09-13  5:34                   ` David Wagner
2006-09-13  6:17                     ` Kyle Moffett
2006-09-13  6:26                       ` David Wagner
2006-09-13  6:49                         ` Kyle Moffett [this message]
2006-09-13  6:59                           ` David Wagner
2006-09-13  8:12                             ` Kyle Moffett
2006-09-14 22:38                               ` David Wagner
2006-09-15  7:28                                 ` Stefan Richter
2006-09-13 10:45                         ` Martin Mares
2006-09-13 11:13                           ` Jan Engelhardt
2006-09-13  6:26                       ` Jan Engelhardt
2006-09-13 19:49                         ` Willy Tarreau
2006-09-13  8:51                 ` Stefan Richter
2006-09-14 23:04                 ` Bill Davidsen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \
    --subject='Re: R: Linux kernel source archive vulnerable' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).