desktop-packages team mailing list archive

[Valentin Crone <209746@xxxxxxxxxxxxxxxxxx>]

The cp command use umask permission by default, it seem logic that nautilus do the same thing. cp don't preserve chmod and chown by default.
This fake bug can be resolved by adding a new feature that purpose to preserve permissions, or by choosing new permissions on a Window before copy.
Example by adding a "Advanced paste" option in the menu, under the normal "Paste" option.

Advanced paste can be a Window that purpose to preserve or not permissions, or/and define new permission for files and for folders copied.
I think it's the best way to solve this problem...

-- 
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to nautilus in Ubuntu.
https://bugs.launchpad.net/bugs/209746

Title:
  File permissions are incorrect during file copy

Status in Nautilus:
  New
Status in nautilus package in Ubuntu:
  Triaged

Bug description:
  Binary package hint: nautilus

  From http://bugzilla.gnome.org/show_bug.cgi?id=458397
  reported by Roberto Zunino:

  When copying files, files are created with the default umask permissions
  instead of using the permissions of the file being copied. Permissions are then
  "fixed" after the copy has been completed. This however leaves a window of
  vulnerability.

  Real world example: I just copyed my old home (perms=700) to a new disk. This
  took quite a long time, during which my home had permissions 775.

  Steps to reproduce:
  1. Create a folder and put some large files inside
  2. chmod 700 folder
  3. Nautilus-copy it somewhere else

  Actual results:
  while copying, ls -d folder_copy shows 775 perms, and other users can go in and
  read inside the folders

  Expected results:
  folder_copy should be created with 700 perms

  Does this happen every time?
  yes

  Other information:
  The Right Thing would be to pass the correct permissions to open()/mkdir() etc.

  Failing that, a good enough easier fix would be to set umask to 700&old_umask
  for the copying stuff.

  -----[ End of bug report by Roberto Zunino
  ]-------------------------------------------

  I can reproduce this bug now with nautilus version 1:2.20.0-0ubuntu7.1
  under Ubuntu 7.10 (Gutsy). I tried to copy a single regular file with
  the permissions set to 600, so the problem is not limited to copying
  directories.

  I'm marking this as a security vulnerability because under appropriate
  circumstances it can allow local users to read other's files
  effectively bypassing the permissions set by the owner. It is true
  that many users won't be affected by this but that's not a valid
  reason to ignore the problem.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nautilus/+bug/209746/+subscriptions