Bjørn Mork <[email protected]> wrote:
Laurent Bigonville <[email protected]> writes:
> Le 20-10-26 à 21:40, Marc Haber a écrit :
>
>> ¹ having 750 directories breaks tab completion and shell globbing
>>
> But it protects the snippets installed by local administrators that
> have potentially wrong permissions, /etc/sudoers is 0440 already.
"protects". Or do you want to analyse the content of those snippets
too?
Well it prevents an attacker from analyzing the snippets, the exact
reason why /etc/sudoers is 0440.
How many other files should be protetced against the local administrator
messing up permissions?
We could start with the ones that our upstreams think require locked
down permissions, already.
I still find the "it breaks tab-completion" argument weak compared to
adding a layer of security on these snippets
