-
-
Notifications
You must be signed in to change notification settings - Fork 683
Closed
Labels
enhancementNew feature or requestNew feature or request
Description
The logic in general_bad_file_permissions
seems to ignore stat.S_IXOTH
(execute by others), which is the most dangerous of all the POSIX file flags.
It raises a high severity issue for S_IWOTH
(write by others) and it raises a medium severity issue for S_IXGRP
(execute by group).
The following test raises no issues:
import os
import stat
os.chmod('/path/to/binary/i/just/uploaded', stat.S_IXOTH)
The guide referenced in the file documents why it is bad to have this flag:
https://security.openstack.org/guidelines/dg_apply-restrictive-file-permissions.html#testing-guide
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or request