keybase / keybase/client

security bug: world read/write permissions for `/keybase` on linux (also, that's a non-standard location)

Open
#9,758 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
9.2k
Forks
1.3k
Avg merge
12h 58m
Merged PRs (30d)
56

Description

The `post_install.sh` script gives world read-write-execute permission on a directory (`chmod 777 /keybase`).

**edit** I see that I've just duplicated a comment from @ptman: https://github.com/keybase/client/issues/4739#issuecomment-256976014 (searching for "/keybase" was an overmatch as `/` was ignored). But IMO the security matter needs a bigger (separate) spotlight anyway. I suggest using this ticket for the security problem, and https://github.com/keybase/client/issues/4739 for the file location problem.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by inspecting post_install.sh and the installation path that applies chmod 777 to /keybase. Determine the intended permissions and verify that installation no longer grants world read, write, and execute access; issue 4739 provides the separate context about the non-standard location.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, shell
Domain
operating-systems, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.