Bug 214334 - databases/couchdb: local filesystem permissions are too permissive
Summary: databases/couchdb: local filesystem permissions are too permissive
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Jimmy Olgeni
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-11-08 19:17 UTC by Dave Cottlehuber
Modified: 2016-12-16 09:31 UTC (History)
0 users

See Also:
bugzilla: maintainer-feedback? (olgeni)

Attachments
v1 patch (1.67 KB, text/plain)
2016-11-08 19:17 UTC, Dave Cottlehuber 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Dave Cottlehuber freebsd_committer freebsd_triage 2016-11-08 19:17:22 UTC 
Created attachment 176799 [details]
v1 patch

# issue

couchdb config files and databases should only be readable by 
the API, or user/group members of couchdb/couchdb. The current
port provides direct access for non-privileged local users
through the filesystem, allowing bypassing of the reader/writer
privileges enforced by CouchDB API.

# fix

restrict all couch-related runtime data to 0750/0640 permissions
and 0600 specially for the local.ini file which contains PBKDF2-
hashed database administrator level passwords.
Comment 1 Dave Cottlehuber freebsd_committer freebsd_triage 2016-12-14 07:52:36 UTC 
bump olgeni@
Comment 2 commit-hook freebsd_committer freebsd_triage 2016-12-16 09:21:48 UTC 
A commit references this bug:

Author: olgeni
Date: Fri Dec 16 09:21:24 UTC 2016
New revision: 428664
URL: https://svnweb.freebsd.org/changeset/ports/428664

Log:
  Use more restrictive permissions for CouchDB's data and configuration
  files.

  PR:		214334
  Submitted by:	Dave Cottlehuber

Changes:
  head/databases/couchdb/Makefile
  head/databases/couchdb/pkg-plist
Comment 3 Jimmy Olgeni freebsd_committer freebsd_triage 2016-12-16 09:31:45 UTC 
Fixed - thank you!