Pedro, could you update the upstream report description to match this one please?
** Summary changed: - Permission of symlinked source file/folder set to 777 if symlink is copied via nautilus + Subscribe someone else Search Search arand • Launchpad > Ubuntu > “nautilus” package Overview / Code / Bugs / Blueprints / Translations / Answers Bug #418135 reported by arand on 2009-08-24 (Activity log) Bug #418135: This report is public edit Security vulnerability Permissions of symlinked source file/folder set to 777 if symlink is copied via nautilus ** Description changed: Binary package hint: nautilus TEST CASE: - 1. Create a symlink inside ~/ linking to either ~ or a directory within ~ - 1. Launch nautilus - 2. Copy directory ~ to other location (e.g. /tmp) - 4. Check permissions of the symlinked folder (the source, not the copy) + 1. Create a symlink to a file or folder, on which you normally are able change permissions. (touch ~/testfile && ln -s ~/testfile ~/testlink) + 2. Copy the symlink to anywhere using Nautilus (ctrl+c && ctrl+v) + 3. Check permissions of the symlinked file or folder - Result: source ~ or folder permissions is changed to 777 (drwxrwxrwx user:user) - Expected behaviour: permissions should be unchanged (755, drwxr-xr-x user:user) + Result: Symlinked file or folder permissions are changed to 777 (drwxrwxrwx user:user) + Expected behaviour: Permissions of symlinked file folder should be unchanged (To revert, simply use "chmod 755 foldername") - - Another side-effect of this is that on startup, gnome(?) gives an error - about the .drmc file and permissions (although it does only complain at - that file not being 644 [which it IS]) - - I'm flagging this as a security vulnerability since this allows unwanted - write access to user's directory. ** Tags added: symlink ** Tags removed: home ** Summary changed: - Subscribe someone else Search Search arand • Launchpad > Ubuntu > “nautilus” package Overview / Code / Bugs / Blueprints / Translations / Answers Bug #418135 reported by arand on 2009-08-24 (Activity log) Bug #418135: This report is public edit Security vulnerability Permissions of symlinked source file/folder set to 777 if symlink is copied via nautilus + Permissions of symlinked source file/folder set to 777 if symlink is copied via nautilus ** Description changed: Binary package hint: nautilus TEST CASE: 1. Create a symlink to a file or folder, on which you normally are able change permissions. (touch ~/testfile && ln -s ~/testfile ~/testlink) 2. Copy the symlink to anywhere using Nautilus (ctrl+c && ctrl+v) 3. Check permissions of the symlinked file or folder Result: Symlinked file or folder permissions are changed to 777 (drwxrwxrwx user:user) Expected behaviour: Permissions of symlinked file folder should be unchanged - (To revert, simply use "chmod 755 foldername") ** Description changed: Binary package hint: nautilus TEST CASE: 1. Create a symlink to a file or folder, on which you normally are able change permissions. (touch ~/testfile && ln -s ~/testfile ~/testlink) 2. Copy the symlink to anywhere using Nautilus (ctrl+c && ctrl+v) 3. Check permissions of the symlinked file or folder Result: Symlinked file or folder permissions are changed to 777 (drwxrwxrwx user:user) Expected behaviour: Permissions of symlinked file folder should be unchanged + + This does not allow setting permissions which your user could not do + with chmod anyway, and hence is not a privilege escalation issue. -- Permissions of symlinked source file/folder set to 777 if symlink is copied via nautilus https://bugs.launchpad.net/bugs/418135 You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is a bug assignee. -- desktop-bugs mailing list desktop-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
