Skip to content

general_bad_file_permissions permits most dangerous flag #569

@tonybaloney

Description

@tonybaloney

The logic in general_bad_file_permissions seems to ignore stat.S_IXOTH (execute by others), which is the most dangerous of all the POSIX file flags.

It raises a high severity issue for S_IWOTH (write by others) and it raises a medium severity issue for S_IXGRP (execute by group).

The following test raises no issues:

import os
import stat

os.chmod('/path/to/binary/i/just/uploaded', stat.S_IXOTH)

The guide referenced in the file documents why it is bad to have this flag:
https://security.openstack.org/guidelines/dg_apply-restrictive-file-permissions.html#testing-guide

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions