search

WhitewaterFoundry / Pengwin-Enterprise

Enterprise-compatible WSL distribution.
Other
63 stars 11 forks source link

/etc/shadow is world readable #67

Closed imgrant closed 2 years ago

imgrant commented 2 years ago

Describe the bug /etc/shadow is world-readable

To Reproduce Steps to reproduce the behavior:

  1. Install Pengwin Enterprise 8 (e.g. from Microsoft Store, as I did)
  2. Start Penwing Enterprise, and follow the create a new user process that is kickstarted
  3. This involves setting a root password, a new username, and a password for the user
  4. Check the permissions on /etc/shadow (ls -lh /etc/shadow)
  5. Observe it is world readable:
[ian@pengwin8 ~]$ ls -lh /etc/shadow*
-rw-r--r-- 1 root root 706 Oct 19 11:24 /etc/shadow
-rw-r--r-- 1 root root 576 Oct 19 11:24 /etc/shadow-

Expected behavior /etc/shadow should probably have tighter restrictions, no? It does usually in most (all?) Linux installations.

Additional context Clearly the security implications are probably less severe in the WSL context, but best practice should still be adhered to.

Insert here:

~WLinux~ Pengwin Enterprise 8 Version

Find: Settings->Apps->Apps & features->WLinux->Advanced Options->Version.

Insert here: 8.4.9.0

Windows Build

Run 'systeminfo | findstr /C:"OS"' in Command Prompt and insert here:

OS Name: Microsoft Windows 11 Pro OS Version: 10.0.22000 N/A Build 22000 OS Manufacturer: Microsoft Corporation OS Configuration: Standalone Workstation OS Build Type: Multiprocessor Free BIOS Version: Dell Inc. 1.16.0, 09/07/2021

For help on retrieving: https://docs.microsoft.com/en-us/windows/wsl/troubleshooting#check-your-build-number

crramirez commented 2 years ago

Hello,

Thanks for reporting. We will check, probably the permissions were changed during the image creation.

Regards, Carlos

crramirez commented 2 years ago

Hello,

I found the issue, the fix is on the way. It may take some days during the testing and also the Microsoft Store certification.

Regards, Carlos

crramirez commented 2 years ago

Hello @imgrant,

The fixed version is in store now. The next time that you create a Pengwin Enterprise distro it will have the right permissions. However, for your current installation, you'll need to change it manually.

Thanks for your help.

Regards, Carlos

imgrant commented 2 years ago

Thanks for letting me know!