ITADN

.rebel_readline_history is readable by all users on unix systems

#224OpenGAumala 创建于 2025-05-01
G
GAumalacommented
I was using rebel-readline in a Linux server with multiple users when I noticed that the generated history file has 644 permissions, which means that: - owner can read and write - group members can read - all users can read History files may contain sensitive information, so they should use 600 permissions, excluding everyone but the owner from reading or writing. While it takes less than 5 seconds to manually update file permissions, it would be a big security improvement if rebel-readline already handled it. Most history files on my system already use secure permissions by default. ``` $ ls -la ~/ | grep history -rw------- 1 gabriel gabriel 7269 Feb 19 13:48 .bash_history -rw------- 1 gabriel gabriel 10935 Apr 28 15:19 .clojure_history -rw------- 1 gabriel gabriel 10999 Apr 30 15:29 .node_repl_history -rw-r--r-- 1 gabriel gabriel 0 Mar 23 21:42 .python_history -rw-r--r-- 1 gabriel gabriel 89 Apr 4 13:44 .rebel_readline_history -rw------- 1 gabriel gabriel 167433 Apr 30 22:49 .zsh_history ``` `jline-terminal` is most likely creating the history file with default permissions. I don't think they have a option to change this, but maybe rebel-readline can create the file with correct permissions before creating the line reader?
0 条评论