gap-system
User, group and permissions in release tarballs
Currently, the release tarballs (e.g. https://github.com/gap-system/gap/releases/download/v4.12.0/gap-4.12.0.tar.gz) contain user and group information:
drwx------ horn/110 0 2022-08-18 16:57 gap-4.12.0/pkg/
If one blindly extracts the tarball, this is unexpected on a single user system and a security risks on a multi user system, I think. Additionally, the pkg directory has permissions 700, which makes the installation unusable when starting GAP as a different user.
Suggestion: change user and group to numeric ID 0, and change the permissions of the pkg directory to 755.
This is an unfortunate side effect of the workaround for https://github.com/gap-system/gap/issues/5011 . Now that the .exe was built we could just restore the correct .tar.gz.
However I disagree that this is a security issue. Blindly extracting tarballs is the real security issue.
This is an unfortunate side effect of the workaround for #5011 . Now that the .exe was built we could just restore the correct .tar.gz.
Ah, I see. From my side we can close this issue if you don't think this has additional value over the existing issue.
Blindly extracting tarballs is the real security issue.
I definitely agree :D
Another related bug: the permissions for the pkg dir in the tarball are 0700. We should of course ensure they are 0755.