extern/atuin
1
0
Fork 0
mirror of https://github.com/atuinsh/atuin.git synced 2025-06-20 18:07:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(perm): set umask 077 (#1554)

Browse Source 
This ensures no other user can read shell history data

Resolves #1250
This commit is contained in:
Ellie Huxtable 2024-01-12 18:52:39 +00:00 committed by GitHub
parent 99249ea319
commit 4d41a741f0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Cargo.lock generated
View File

@ -191,6 +191,7 @@ dependencies = [
"ratatui", "ratatui",
"rpassword", "rpassword",
"runtime-format", "runtime-format",
"rustix",
"semver", "semver",
"serde", "serde",
"serde_json", "serde_json",

1
Cargo.toml
View File

@ -44,6 +44,7 @@ whoami = "1.1.2"
typed-builder = "0.18.0" typed-builder = "0.18.0"
pretty_assertions = "1.3.0" pretty_assertions = "1.3.0"
thiserror = "1.0" thiserror = "1.0"
rustix = {version = "0.38.28", features=["process", "fs"]}
[workspace.dependencies.reqwest] [workspace.dependencies.reqwest]
version = "0.11" version = "0.11"

1
atuin/Cargo.toml
View File

@ -65,6 +65,7 @@ fs-err = { workspace = true }
whoami = { workspace = true } whoami = { workspace = true }
rpassword = "7.0" rpassword = "7.0"
semver = { workspace = true } semver = { workspace = true }
rustix = { workspace = true }
runtime-format = "0.1.3" runtime-format = "0.1.3"
tiny-bip39 = "1" tiny-bip39 = "1"
futures-util = "0.3" futures-util = "0.3"

7
atuin/src/command/mod.rs
View File

@ -2,6 +2,8 @@ use clap::{CommandFactory, Subcommand};
use clap_complete::{generate, generate_to, Shell}; use clap_complete::{generate, generate_to, Shell};
use eyre::Result; use eyre::Result;
use rustix::{fs::Mode, process::umask};
#[cfg(feature = "client")] #[cfg(feature = "client")]
mod client; mod client;
@ -46,6 +48,11 @@ pub enum AtuinCmd {
impl AtuinCmd { impl AtuinCmd {
pub fn run(self) -> Result<()> { pub fn run(self) -> Result<()> {
// set umask before we potentially open/create files
// or in other words, 077. Do not allow any access to any other user
let mode = Mode::RWXG | Mode::RWXO;
umask(mode);
match self { match self {
#[cfg(feature = "client")] #[cfg(feature = "client")]
Self::Client(client) => client.run(), Self::Client(client) => client.run(),