|
Vulnerability permissions Affected MacOS X Description kangoo found following. Permissions of /Users/yourname/Desktop which show your desktop is xrwxrwxrwx, allowing every user to read/write on your own Desktop folder. Turns out that those created during the beta test period were the problematic ones. After scrubbed the disk and reinstallayion all accounts shoul have the correct permissions. However, after questioning few people about these permission corruption it's sounds like it can happen even on a fresh install (not on top of a (erased) beta). For example, a user reports having rw set for everybody on every user's desktop folder on a clean install. The same partition holds a French MacOS 9.1, and OSX is very likely to be installed in French. He says he has not installed "special" soft (Xfree or other hacks). Dev.Tools are installed. Another user pointed out that it might be a localization bug. As it already happened in the past, we are likely to consider this option as a serious one. 'patpro' managed to reproduce the permission corruption of Desktop. Here is step by step what he has done: 1- booted an english install of OSX and logged in as admin User (english). 2- added a user (test) 3- logged out 4- logged in as 'test' 5- tuned OSX so that 'test' is a french user. 6- logged out and in to check /Users/test/Desktop's permission: drwx------ 7- logged out and logged in as root (english) (bad bad boy) 8- set prefered language to french 9- logged out and in to ensure everything will work in french 10- added a user (test2) 11- logged out 12- logged in as 'test2' (everything looks english) 13- checked /Users/test2/Desktop's permission : drwxrwxrwx 14- TADAAAAM here we are ! Here is the probleme: Desktop is not defined in all of these frameworks: bash-2.05$ ls -l user.template/ total 7 drwx------ 2 patpro wheel 512 Nov 14 2000 Documents drwx------ 13 patpro wheel 512 Feb 21 03:56 Library drwx------ 2 patpro wheel 512 Nov 15 2000 Movies drwx------ 2 patpro wheel 512 Nov 15 2000 Music drwx------ 2 patpro wheel 512 Nov 15 2000 Pictures drwxr-xr-x 3 patpro wheel 512 Nov 15 2000 Public drwxr-xr-x 2 patpro wheel 512 Nov 23 2000 Sites For French, German, Italian and Spanish, Desktop is created at login time with drwxrwxrwx permission. For English, Dutch and Japanese user.template, the Desktop is inside the tarball: bash-2.05$ ls -l user.template/ total 8 drwx------ 2 patpro wheel 512 Jan 31 00:17 Desktop drwx------ 2 patpro wheel 512 Nov 14 2000 Documents drwx------ 15 patpro wheel 512 Feb 3 01:40 Library drwx------ 2 patpro wheel 512 Nov 15 2000 Movies drwx------ 2 patpro wheel 512 Nov 15 2000 Music drwx------ 2 patpro wheel 512 Nov 15 2000 Pictures drwxr-xr-x 3 patpro wheel 512 Nov 15 2000 Public drwxr-xr-x 3 patpro wheel 512 Feb 14 01:31 Sites ... with the right permissions. Solution Fix: chmod 755 or chmod 750 /Users/yourname/Desktop Just untar the user.gnutar add the Desktop folder with drwx------ and tar.