search

cytopia / mysqldump-secure

[sh] Encrypted mysqldump script with compression, logging, blacklisting and Nagios/Icinga monitoring integration
https://mysqldump-secure.org
147 stars 38 forks source link

[sec] chmod is done after dumping to disk #17

Closed cytopia closed 8 years ago

cytopia commented 8 years ago

If a specific chmod is specified for the target files, it is done after the files have been written. This could lead to a potential security problem:

Users could (if the target dir permits it) read the whole file while it is being written.

Workaround: use umask to prepare the file creation (works also with others than touch)

(umask 077; touch file)  # creates a 600 (rw-------) file
(umask 002; touch file)  # creates a 664 (rw-rw-r--) file