1557
close($outFH);
The first time the program runs, it might create a new file that inherits the permissions from its
environment. A file listing might look like:
Example Language: (Result)
-rw-r--r-- 1 username 13 Nov 24 17:58 secretFile.out
This listing might occur when the user has a default umask of 022, which is a common setting.
Depending on the nature of the file, the user might not have intended to make it readable by
everyone on the system.
The next time the program runs, however - and all subsequent executions - the chmod will set the
file's permissions so that the owner, group, and world (all users) can read the file and write to it:
Example Language: (Result)
-rw-rw-rw- 1 username 13 Nov 24 17:58 secretFile.out
Perhaps the programmer tried to do this because a different process uses different permissions
that might prevent the file from being updated.
Example 4:
This program creates and reads from an admin file to determine privilege information.
If the admin file doesn't exist, the program will create one. In order to create the file, the program
must have write privileges to write to the file. After the file is created, the permissions need to be
changed to read only.
Example Language: Go (Bad)
const adminFile = "/etc/admin-users"
func createAdminFileIfNotExists() error {
file, err := os.Create(adminFile)
if err != nil {
return err
}
return nil
}
func changeModeOfAdminFile() error {
fileMode := os.FileMode(0440)
if err := os.Chmod(adminFile, fileMode); err != nil {
return err
}
return nil
}
os.Create will create a file with 0666 permissions before umask if the specified file does not exist. A
typical umask of 0022 would result in the file having 0644 permissions. That is, the file would have
world-writable and world-readable permissions.
In this scenario, it is advised to use the more customizable method of os.OpenFile with the
os.O_WRONLY and os.O_CREATE flags specifying 0640 permissions to create the admin file.
This is because on a typical system where the umask is 0022, the perm 0640 applied in
os.OpenFile will result in a file of 0620 where only the owner and group can write.
Example 5:
The following command recursively sets world-readable permissions for a directory and all of its
children:
CWE Version 4.14
CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-732: Incorrect Permission Assignment for Critical Resource