Issue 7948 - mdb_copy insecure permissions
Summary: mdb_copy insecure permissions
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: slapd (show other issues)
Version: 2.4.39
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-09-24 07:20 UTC by Geert Hendrickx
Modified: 2015-07-02 17:44 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description Geert Hendrickx 2014-09-24 07:20:02 UTC 
Full_Name: Geert Hendrickx
Version: 2.4.39
OS: centos6
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (212.123.14.2)


mdb_copy creates a copy using the default umask.  This usually leads to insecure
(world readable) copies, as typically an LDAP databse is 600 owned by some
unprivileged ldap user.

I suggest to copy the behaviour of cp, scp, rsync etc: preserve mode by default,
preserve all metadata (uid:gid, mode, mtime, atime ...) when invoked with -p ?
Comment 1 Howard Chu 2014-10-14 12:21:16 UTC 
geert@hendrickx.be wrote:
> Full_Name: Geert Hendrickx
> Version: 2.4.39
> OS: centos6
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (212.123.14.2)
>
>
> mdb_copy creates a copy using the default umask.  This usually leads to insecure
> (world readable) copies, as typically an LDAP databse is 600 owned by some
> unprivileged ldap user.

The mode has changed to 0600 as of commit 58ddb5527bd4868bb7017cfe2051bc2e24bcf5a8

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/
Comment 2 OpenLDAP project 2014-10-14 12:21:48 UTC 
fixed in mdb.master
Comment 3 Howard Chu 2014-10-14 12:21:48 UTC 
changed notes
changed state Open to Test
moved from Incoming to Software Bugs
Comment 4 Quanah Gibson-Mount 2014-12-11 01:05:28 UTC 
changed state Test to Release
Comment 5 Quanah Gibson-Mount 2015-07-02 17:44:58 UTC 
changed state Release to Closed