0000087: /etc/profile permissions

Notes
(0000014) jonli447 (developer) 2007-01-26 02:41	Why do non-root accounts need to access /etc/profile? The box should be restrictive because it may be used to offer services to the open internet. Allowing all accounts to access /etc/profile may pose a security issue. Please let us know the reasons why you believe /etc/profile should be world readable. Thx.

(0000016) armstation (reporter) 2007-01-27 12:19	I should have explained this better. The default LinkStation image only allows read-execute (and write) to the root user. (mode 700). In addition to those permissions, there should be just read access allowed for other users (mode 644). This is important when additional users need to be added. For instance if you create a database user and use that account to setup a database, this user will not be able to source /etc/profile. Only root should be able to write to /etc/profile, but all users should be able to read it. I don't see any security issue as long as it is just read-only, not write access. Consider the default Ubuntu /etc/profile permissions (644): -rw-r--r-- 1 root root 369 2006-10-25 08:26 /etc/profile

(0000027) jonli447 (developer) 2007-02-17 00:46	Changes will be implemented in the next release.

Relationships