diff options
Diffstat (limited to 'todo.org')
| -rw-r--r-- | todo.org | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -1482,7 +1482,9 @@ archsetup:298 marks a step complete only when its function returns 0, but error_ ** TODO [#C] cmail password decrypted world-readable before chmod :bug:security:solo:quick:cmail: Grading: security carve-out — brief local plaintext exposure of the mail password, requires a concurrent local shell during install; narrow window = low severity = P3 = [#C]. scripts/cmail-setup-finish.sh:52 gpg-decrypts to ~/.config/.cmailpass at the process umask (often 0644), then chmod 600 on the next line. Fix: =(umask 077; gpg ... --output ...)= or decrypt to a mktemp 0600 file and mv into place (mirror the import-wireguard mktemp -d 0700 pattern). See findings doc (S4). -** TODO [#C] Installer sudoers.pacnew blind copy risks lockout :bug:solo:quick: +** DONE [#C] Installer sudoers.pacnew blind copy risks lockout :bug:solo:quick: +CLOSED: [2026-07-20 Mon] +Fixed in c80e855: extracted replace_sudoers_pacnew, which runs visudo -cf on the pacnew and only copies a validated file (warns and keeps the working sudoers otherwise). TDD via tests/installer-steps/test_replace_sudoers_pacnew.py. Grading: Major severity (a malformed sudoers locks out privilege escalation) x rare edge case = P3 = [#C]. archsetup:1146 does =[ -f /etc/sudoers.pacnew ] && cp /etc/sudoers.pacnew /etc/sudoers= with no validation, right before the NOPASSWD rule at 1183. Fix: =visudo -cf /etc/sudoers.pacnew && cp ... || error_warn=. See findings doc (S2). ** TODO [#C] WireGuard import leaves full-tunnel VPN live on failure :bug:solo:network: |