← All tasks
cppobsproject/obs-websocket #620Not a task: not reproduced

obs-websocket-4.8.0-1_amd64.deb contains files with mode 777

envgap__obsproject__obs-websocket-620

01 / FAILURE SIGNATURE

As reported upstream

No identifying execution failure has been captured.
Not a benchmark task.
  • In a clean container the reported failure did not reproduce, or the known fix did not make the project run.

02 / ENVIRONMENT RECIPE

Base commit
a42398c457d0a8c1b05b729b6b2f7afb22932ac4
Manifest
CMakeLists.txt
Reproduce
Awaiting issue-specific recipe
Run under trace
Awaiting a meaningful runtime command

03 / ORIGINAL ISSUE TEXT

obsproject/obs-websocket #620 · read the original issue
##### Issue type

<!--- Uncomment one of the two options below. -->



Bug report



##### Description

`obs-websocket-4.8.0-1_amd64.deb` (and possibly other/older release packages) contains files with an inappropriate mode (777)



I haven't taken a look at any other packages, but depending on the root cause this could impact other OS's.



This would allow a local low-privilege user of the system to add/replace certain files related to the plugin.



The files should have a more appropriate mode, such as 775



##### Steps to reproduce and other useful info



Inspect the `.deb` file with `dpkg -c` and observe files with mode 777



```

% dpkg -c ~/downloads/obs-websocket-4.8.0-1_amd64.deb | awk '$1 ~ /........w./'

drwxrwxrwx root/root         0 2020-05-27 07:56 ./usr/share/

drwxrwxrwx root/root         0 2020-05-27 07:57 ./usr/share/obs/obs-plugins/obs-websocket/

drwxrwxrwx root/root         0 2020-05-27 07:57 ./usr/share/obs/obs-plugins/obs-websocket/locale/

```

Install the `.deb` package using `dpkg -i`. Observe, for any file that didn't already exist on the OS (i.e. except for `/usr/share/`), the file was created with mode 777.



(I can't show the output of this - I already changed my files to be mode 755)



##### Technical information

- **Operating System** : Debian

- **OBS Studio version** : N/A

- **obs-websocket version** : 4.8.0-1

Continue on GitHub ↗

04 / LABELS

Labels from the report text only; not yet run

No supported category has been assigned.

Label rules and the text that matched
[]