Bundler binstubs executables permissions are hardcoded

[parameme]

Hi people,

We have noticed that the bundler binstubs executables permissions seem to be hardcoded (0755) if I am reading the source right. Was there some deeper security issue here? Our FreeBSD operations team would like to be able to influence the group permissions at least (ie. making the directory and files group-writeable for example) - perhaps a commandline or config option in ~/.bundler/config ?

parameme

[ixti]

0755 is default permission mode for executables. If you want to restrict that - use umask. If you want to make directory group-writeable, create it before running binstubs.

[v-yarotsky]

Sorry for bumping old topic, but I'm still not sure what does 'default permission mode for executables' mean? Specifically, why bundler does not use 0777 & ~File.umask?

[indirect]

because that would be 493, which makes no sense to me as a permission mode...

[indirect]

(oops, my bad, wasn't converting it back to octal. sorry.)

[indirect]

Back to the problem at hand, where is Bundler setting the permissions of anything to 0755? I only see File.chmod((0777 & ~File.umask), destination) in git_proxy.rb.

[v-yarotsky]

it does so here:
https://github.com/bundler/bundler/blob/b21e27cdf633777e0b93a789de7ff43f8d73bc1d/lib/bundler/installer.rb#L180

It doesn't really work well for me, as our app can be deployed by several devs with separate system accounts within one group, so it is group permissions what matters most.

[indirect]

Oh, I see. Yes, I agree that 0755 & ~File.umask is the correct behaviour. We should fix that.

On Jan 2, 2014, at 2:29 PM, v-yarotsky notifications@github.com wrote:

it does so here:
https://github.com/bundler/bundler/blob/b21e27cdf633777e0b93a789de7ff43f8d73bc1d/lib/bundler/installer.rb#L180

It doesn't really work well for me, as our app can be deployed by several devs with separate system accounts within one group, so it is group permissions what matters most.

—
Reply to this email directly or view it on GitHub.

[v-yarotsky]

Cool, I'll open a pull request for that. Cheers! :)