#484673 file permissions for files potentially including credential information

Package:
debian-policy
Source:
debian-policy
Submitter:
Nico Golde
Date:
2010-08-18 19:48:05 UTC
Severity:
wishlist
#484673#5
Date:
2008-06-05 13:37:38 UTC
From:
To:
Package: debian-policy
Version: 3.7.3.0
Severity: wishlist

Hi,
after discussing #484570 I think it would be a good idea to
have a policy rule to install configuration files that could
potentially include login credential information with
permissions 0660 instead of forcing admins to check file
permissions on their own if they introduce some kind of
login mechanism later if the software provides this
functionality.

Kind regards
Nico
#484673#10
Date:
2008-06-05 15:30:37 UTC
From:
To:
Hi,

        We can add it as a recommendation yes. I would hesitate to make
 it stronger until we know the number of packages that would be affected
 by this policy change.

        Would you care to suggest wording for the policy change, along
 with the rationale (perhaps distilled out of Bug#484570)?

        manoj
#484673#15
Date:
2008-06-08 14:47:40 UTC
From:
To:
Hi Manoj,
* Manoj Srivastava <srivasta@acm.org> [2008-06-05 17:34]:

I currently see no way to determine the number of packages
affected by this :/

Steffen Joeris and me created the following proposal:

10.7.6 Secure permissions for configuration files

Configuration files including or potentially including user credential data
like passwords should have proper permissions to ensure that those can not be
abused by other users. Thus the file needs to be installed with the permission
bit for other users than the owner set to 0 (e.g. 600 or 640).

What do you think?

Kind regards
Nico