diff options
| author | Craig Jennings <c@cjennings.net> | 2026-07-20 23:31:37 -0500 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-07-20 23:31:37 -0500 |
| commit | 5ce5d6903b8178e3502f52fcc2723e9cc44766d5 (patch) | |
| tree | 8b364b67993c14ec32694d4f8bca5c7594941f06 /todo.org | |
| parent | 282132a65df3cf7b841f7be8e386464b7a1e1b57 (diff) | |
| download | archsetup-5ce5d6903b8178e3502f52fcc2723e9cc44766d5.tar.gz archsetup-5ce5d6903b8178e3502f52fcc2723e9cc44766d5.zip | |
docs: close stale cmail umask task (fixed in dffecf5)
Diffstat (limited to 'todo.org')
| -rw-r--r-- | todo.org | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -1486,7 +1486,9 @@ CLOSED: [2026-07-20 Mon] Fixed in 6de55d2: run_step records the state marker whenever the step function returns (a return past error_fatal's exit means only a non-fatal warning is left), added local to run_step/show_status, and captured pacman's real exit in the refresh loop. TDD via tests/installer-steps/test_run_step.py. Grading: Major severity (resume re-runs steps and can abort on a survivable warning) x some (a step whose last action is a non-fatal failure) = P3 = [#C]. archsetup:298 marks a step complete only when its function returns 0, but error_warn/run_task return 1, so a non-fatal-failing step never writes its marker and re-runs on resume. Also archsetup:1034 reports =$?= of the =false= test, not pacman's real exit code; and run_step locals (290/318) leak to global scope. Fix: step functions =return 0= explicitly (or gate run_step on a per-step error flag); capture the real exit code; add =local=. See findings doc (S1). -** TODO [#C] cmail password decrypted world-readable before chmod :bug:security:solo:quick:cmail: +** DONE [#C] cmail password decrypted world-readable before chmod :bug:security:solo:quick:cmail: +CLOSED: [2026-07-20 Mon] +Already fixed in dffecf5 (before this session): decrypt_to_secure wraps the gpg decrypt in a 0077-umask subshell so the file is 0600 from creation, with tests/cmail/ verifying the umask at write time. The task was stale; verified green and closed. Grading: security carve-out — brief local plaintext exposure of the mail password, requires a concurrent local shell during install; narrow window = low severity = P3 = [#C]. scripts/cmail-setup-finish.sh:52 gpg-decrypts to ~/.config/.cmailpass at the process umask (often 0644), then chmod 600 on the next line. Fix: =(umask 077; gpg ... --output ...)= or decrypt to a mktemp 0600 file and mv into place (mirror the import-wireguard mktemp -d 0700 pattern). See findings doc (S4). ** DONE [#C] Installer sudoers.pacnew blind copy risks lockout :bug:solo:quick: |