Re: Kernelsources writeable for everyone?!

[Rene Scharfe <rene.scharfe@lsrfire.ath.cx>]

Troy Benjegerdes schrieb:
> On Sat, Jun 24, 2006 at 07:17:02PM +0100, Al Viro wrote:
>> On Sat, Jun 24, 2006 at 08:00:50PM +0200, Daniel wrote:
>>> Hi, may be this was reported/asked 999999999 times, but here ist 
>>> the 1000000000th:
>>> 
>>> I have downloaded linux-2.6.17.1 10 min ago and I noticed that 
>>> every file is writeable by everyone. What's going on there?
>> You are unpacking tarballs as root and preserve ownership and 
>> permissions. Don't.
> 
> While it is true that users generally shouldn't be unpacking tarballs
>  as root, It seems rather monumentally stupid for a trusted source
> for a critical system component (aka, kernel.org) to be distributing 
> tarballs like this.

The permissions info within a tarball doesn't mean anything as long as
the file just sits there.  Only when you interpret the contents and
create files and directories they become relevant.

Tar gives you two options: A) set permissions exactly as stored in the
tar file, or B) apply the umask.  Tar archives created by git are
intended to be interpreted using option B), which is the default for GNU
tar if run as non-root.

You can interpret the tar file correctly even if you are root, you just
have to convince tar to apply the umask.

Best regards,
René