On Thu, 26 Jul 2012 01:45:57 +0200, Andreas Beckmann wrote: > There is no indication why this is world writable. > 0775 or 0770 should be sufficient.
Agreed, after looking around in the docs and code a bit, this seems to be only the smarty cache dir used by the admin webinterface. Unless php is run by a different user, restricting write access to www-data should be enough. (And I see no indication of using something else than apache and mod_php). Actually, at the moment it's not used at all: [Thu Aug 16 19:49:17 2012] [error] [client $myip] PHP Warning: require_once(/usr/share/php/smarty/libs//Smarty.class.php): failed to open stream: No such file or directory in /usr/share/phpgacl/admin/gacl_admin.inc.php on line 62 That's #646540, smarty_dir needs to be adjusted too ... > Even if an ordinary local user cannot list the contents of the > directory, he may correctly derive/guess filenames (unless they are > exclusively $(mktemp)) and delete and replace files in there. Well, this is the contents after a first call to the admin page after fixing smarty_dir: # ll /usr/share/phpgacl/admin/templates_c total 32 -rw-r--r-- 1 www-data www-data 1299 Aug 16 20:00 572e144b64275d25211890df439b01e6bd90aad2.file.header.tpl.php -rw-r--r-- 1 www-data www-data 1432 Aug 16 20:00 79204dd7697a3cace93ea134d6231a1c6c1d6d42.file.footer.tpl.php -rw-r--r-- 1 www-data www-data 14990 Aug 16 20:00 8913c7d7e9de742dfb2633c7d3dcc1082dc65aa2.file.acl_admin.tpl.php -rw-r--r-- 1 www-data www-data 2524 Aug 16 20:00 b8fde9755a4c7c788b322ca6648bc62a356bcaa2.file.navigation.tpl.php -rw-r--r-- 1 www-data www-data 957 Aug 16 20:00 c831a1aea621f8a5a5963c7ab1e0930b0744ce65.file.acl_admin_js.tpl.php (Does this belong into /usr/share? Not really ...) > I don't know how phpgacl works, how it uses this directory, what > probelms could possibly arise out of this. Only if the local admin runs php not as root/www-data ... Changing it to 770 in my test install works as expected. > I just wrote the piuparts test for finding world writable directories :-) Thank you :) Cheers, gregor -- .''`. Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06 : :' : Debian GNU/Linux user, admin, and developer - http://www.debian.org/ `. `' Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe `- NP: Treibhaus: Heroes of Woodstock
signature.asc
Description: Digital signature
