Upgrade setting permissions on weewx.conf about weewx HOT 6 CLOSED

Good point. We'll take a look at it.

from weewx.

which files should have 660 permissions?

each time the config file is modified by weectl, weectl makes a copy. weectl does not ensure 660 permissions.

during and upgrade, there may be many copies of the config file. all of those should have the same permissions as the 'active' config file.

if it is weewx-multi configuration, there will be multiple 'active' config files.

so i'm not sure what the right approach is here.

option 1: only modify permissions and ownership when upgrading from a v4 to v5

option 2: always set permissions and ownership

option 3: always set permissions and ownership, but set permissions on every /etc/weewx/*.conf to 660

from weewx.

The only file that bothered me from a security perspective is the /etc/weewx/weewx.conf file as it has login details for 3rd party sites that might be sensitive information. You are right to point out that often has version copies/diffs placed in the same directory with differing names (sometimes appended to the '.conf' side) so all potentially have such information.

In terms of options then your 'option 3' seems the simplest and safest. My initial thought was based on looking at the pkg/debian/postinst file and changing it so following the (current) line 427 it removes other read/write permission, so something like this:

set_config_permissions() {
    echo "Setting permissions $WEEWX_USER:$WEEWX_GROUP on /etc/weewx"
    set_permissions $WEEWX_USER $WEEWX_GROUP /etc/weewx
    chmod o-rw /etc/weewx/*.conf*
}

This might not be perfect as there remains a window of opportunity from setting all files globally readable to removing that on the conf file(s) but given:

• Very short time they would be accessible
• Infrequent nature of such upgrade changes
• Few cases where a WeeWX machine has multiple users of low trust

It would seem quite acceptable to me.

from weewx.

chmod o-rw /etc/weewx/.conf

this is what i was thinking.

from weewx.

I don't understand much about the package manager process, but that seemed like the sort of change that ought to work.

from weewx.

this will appear in weewx 5.1.0

from weewx.