mark2devel / mark2

Minecraft Multi Server Wrapper Written in Python with Twisted; Pull Requests HIGHLY Encouraged, Collaborators Needed Discord: https://discord.gg/zymJygHNpv
Other
207 stars 44 forks source link

Disable setting the user's umask insecurely #105

Closed Combustible closed 4 years ago

Combustible commented 5 years ago

IMO this is a fairly substantial security problem.

For example, if you download minecraft and launch it with mark2 for the first time, all of the folders/config/world/everything will be set to world-writeable. This... is really bad. The user should be able to decide this if they want it by setting their own umask before invoking mark2.

I'll understand if you don't want to merge this, but I wanted to at least submit the request. I think the benefit to people who have their system configured properly far outweighs the potential complaints from new people.