Re: Message "Insecure world writable dir ..."

Ben Giddings wrote:

> Right, but say you create such a trojan -- the trojan is the danger, not 
> the fact the directory is world writeable.

Well, the fact that the directory is world writable is also a danger, since (a) it allowed you to create the trojan in the first place and (b) while it remains writable, other trojans can be created.

> Running such a trojan from 
> within Ruby isn't any more dangerous from running it directly, right?

True.

> Unless the danger is ruby-related, I don't see why Ruby tells you about 
> it.  For example, does the HTTP module warn you when you use 'basic' 
> authentication, explaining that it isn't very secure?  Does it warn you 
> that you're running Windows, an OS known to have lots of security flaws?

I think world writable directories are far more serious than those two examples. The others require some effort to break the system (albeit small, for a true cracker).  World writeable directories in one's execution path can be used for nefarious purposes with almost zero effort.
 
> I can see the complaint about world writable directories containing 
> binaries in a security auditing module, but I'm not convinced about 
> popen/system/`

I agree it's a little strange having Ruby tell you about security issues, but since it's a real and potentially very serious problem, I think it's reasonable that it does.  I'd just prefer it if one could turn warnings off individually, if there is no way to have the problem fixed.

As it happens, I convinced the sysadmin here that it truly was a security risk and he's fixed it.  However, I could imagine very open environments where people might want to have world writable directories like that, because everyone is considered highly trustworthy and having such security would be an unnecessary hindrance.

Cheers,

Harry O.