F.e. setfacl -m d:o::0000 /tmp/clipmenu.hashworks

Add ACLs so noone but the owner can access the clipboard about clipmenu HOT 4 CLOSED

cdown commented on May 12, 2024

Add ACLs so noone but the owner can access the clipboard

from clipmenu.

Comments (4)

cdown commented on May 12, 2024

What scenario are you envisaging this will protect from over the current 0700 Unix permissions?

from clipmenu.

hashworks commented on May 12, 2024

On my systems mkdir -m 0700 isn't doing what one might think it does:

% mkdir -m 0700 foo                                                               1 ↵ [/tmp]
% cd foo                                                                              [/tmp]
% ls -al                                                                          [/tmp/foo]
insgesamt 0
drwx------  2 hashworks hashworks  40  1. Feb 15:02 .
drwxrwxrwt 15 root      root      500  1. Feb 15:02 ..
% touch foobar                                                                    [/tmp/foo]
% ls -al                                                                          [/tmp/foo]
insgesamt 0
drwx------  2 hashworks hashworks  60  1. Feb 15:02 .
drwxrwxrwt 15 root      root      500  1. Feb 15:02 ..
-rw-rw-r--  1 hashworks hashworks   0  1. Feb 15:02 foobar
% setfacl -m d:o::0000 .                                                          [/tmp/foo]
% touch aclfoo                                                                    [/tmp/foo]
% ls -al                                                                          [/tmp/foo]
insgesamt 0
drwx------+  2 hashworks hashworks  80  1. Feb 15:04 .
drwxrwxrwt  15 root      root      500  1. Feb 15:03 ..
-rw-------   1 hashworks hashworks   0  1. Feb 15:04 aclfoo
-rw-rw-r--   1 hashworks hashworks   0  1. Feb 15:02 foobar
%                                                                                 [/tmp/foo]

from clipmenu.

cdown commented on May 12, 2024

I don't see anything unexpected in there.

File permissions inside /tmp/clipmenu.$USER don't matter here, since you can't even get into the directory:

% ls /tmp/clipmenu.cdown | head -1
1001020889 137
% stat /tmp/clipmenu.cdown/'1001020889 137' 
  File: /tmp/clipmenu.cdown/1001020889 137
  Size: 136       	Blocks: 8          IO Block: 4096   regular file
Device: 20h/32d	Inode: 1775706     Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/   cdown)   Gid: ( 1000/   cdown)
Access: 2017-02-01 14:07:29.548363204 +0000
Modify: 2017-01-24 06:08:49.117047788 +0000
Change: 2017-01-24 06:08:49.117047788 +0000
 Birth: -
% sudo -u nobody stat /tmp/clipmenu.cdown/'1001020889 137' 
stat: cannot stat '/tmp/clipmenu.cdown/1001020889 137': Permission denied

If you really care about the permissions of the files inside this directory (which you probably shouldn't), the correct thing is to set your umask.

from clipmenu.

hashworks commented on May 12, 2024

Ah, you're right. My bad.

from clipmenu.

Recommend Projects