From bb530c44450b88c3584f4e50119857599e5a5f40 Mon Sep 17 00:00:00 2001 From: Elrond Date: Fri, 22 Mar 2013 19:12:55 +0100 Subject: [PATCH] Improve fs security for itsdangerous secret. Set mode 700 on the directory, mode 600 on the file. --- mediagoblin/tools/crypto.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/mediagoblin/tools/crypto.py b/mediagoblin/tools/crypto.py index 3294f135..0fb2ba2e 100644 --- a/mediagoblin/tools/crypto.py +++ b/mediagoblin/tools/crypto.py @@ -38,14 +38,18 @@ def setup_crypto(): global __itsda_secret dir = mg_globals.app_config["crypto_path"] if not os.path.isdir(dir): - _log.info("Creating %s", dir) os.makedirs(dir) + os.chmod(dir, 0700) + _log.info("Created %s", dir) name = os.path.join(dir, "itsdangeroussecret.bin") if os.path.exists(name): __itsda_secret = file(name, "r").read() else: __itsda_secret = str(getrandbits(192)) - file(name, "w").write(__itsda_secret) + f = file(name, "w") + f.write(__itsda_secret) + f.close() + os.chmod(name, 0600) _log.info("Created %s", name) -- 2.25.1