rust-lang / rust-lang/cargo

Cargo unpacks files with too restrictive mode (breaking multi-user shared cargo registry)

Open
#3,442 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

A-registries C-feature-request E-hard S-needs-design
Dominant language
Rust
Stars
15.5k
Forks
3k
Avg merge
23h 30m
Merged PRs (30d)
51

Description

I share cargo home directory between multiple user accounts and want to use cargo install from both uids. For this I want all Rust-related things to be group-writable.

But despite of umask is 0002 (new files are group-writable by default) and all directories have mode g+rwxs, some files unpacked by Cargo get usual boring mode 644, preventing clearing directories from other user later.

For example, now I see

drwxrwsr-x 6 rust rust 496 Dec 22 20:12 .multirust/toolchains/nightly/cargo/registry/src/github.com-1ecc6299db9ec823/clippy-0.0.104
-rw-r--r-- 1 rust rust 24K Dec 17 03:28 .multirust/toolchains/nightly/cargo/registry/src/github.com-1ecc6299db9ec823/clippy-0.0.104/CHANGELOG.md

Why files inside the clippy-0.0.104 directory get restrictive permissions when everything else is group-writable? Should Cargo avoid walling non-security-related files against other users when umask is explicitly configured not to do so?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the cargo install path that unpacks registry archives and inspect how extracted file modes interact with the process umask. Reproduce the shared-registry case with umask 0002; done means non-security-sensitive unpacked files retain group-writable permissions and the behavior is covered by a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
cli, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.