Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #74051

Bug#1002797: initramfs-tools: UMASK option doesn't catch all cases

Cross-posted to 2 groups.

Show all headers | View raw

Package: initramfs-tools
Version: 0.140
Severity: normal
Tags: security


Hi.

AFAIU, the UMASK option is there for cases like e.g. when dm-crypt keys
are included in the initramfs.

I played a bit with it, and found that it already doesn't just affect the
final initramfs image, but also parts below /var/tmp/mkinitramfs_*/ .


With "parts" I mean:
- the top level temp dir (/var/tmp/mkinitramfs_*/) is still world-readable
- and even below that, only directories seem affected, while files included
  e.g. via copy_file are not.


So I think,the top level dir should be created with the UMASK as well, or
perhaps even generally with root ownership ...

That should also protect all files not added with initramfs-tools functions,
as well as files included with copy_file but at the root of the initramfs
(which is the top level temp dir... so no intermediate dir would get created
with a securing UMASK).


Thanks,
Chris.

Back to linux.debian.kernel | Previous | Next | Find similar | Unroll thread

Thread

Bug#1002797: initramfs-tools: UMASK option doesn't catch all cases Christoph Anton Mitterer <calestyo@scientia.org> - 2021-12-29 00:40 +0100

csiph-web