security bug: world read/write permissions for `/keybase` on linux (also, that's a non-standard location)
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
The `post_install.sh` script gives world read-write-execute permission on a directory (`chmod 777 /keybase`).
**edit** I see that I've just duplicated a comment from @ptman: https://github.com/keybase/client/issues/4739#issuecomment-256976014 (searching for "/keybase" was an overmatch as `/` was ignored). But IMO the security matter needs a bigger (separate) spotlight anyway. I suggest using this ticket for the security problem, and https://github.com/keybase/client/issues/4739 for the file location problem.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by inspecting post_install.sh and the installation path that applies chmod 777 to /keybase. Determine the intended permissions and verify that installation no longer grants world read, write, and execute access; issue 4739 provides the separate context about the non-standard location.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, shell
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100