UncryptedFileKeyring creates ~/keyring_pass.cfg world readable, ignores keyring-path

Bug #1023433 reported by Scott Moser
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
python-keyring (Ubuntu)
Fix Released
High
Unassigned

Bug Description

I'm using the following config:
[backend]
default-keyring=keyring.backend.UncryptedFileKeyring
keyring-path=/home/ubuntu/xxx

After using an application (python-novaclient) that uses python-keyring, I have a new file in ~/ named 'keyring_pass.cfg'

$ ls -altr ~/keyring_pass.cfg
-rw-r--r-- 1 ubuntu ubuntu 235 Jul 11 14:24 /home/ubuntu/keyring_pass.cfg

There are 2 bugs there
a.) keyring-path is entirely ignored.
b.) keyring_pass.cfg is created with world readable permissions.

This is easily worked around by first creating the file with lower permissions. Ie:
   ( umask 066 && : > ~/keyring_pass.cfg )

I realize that UncryptedFileKeyring is really not intended to be used for anything significant, but that doesn't mean it should store world readable sensitive data by default.

Also, I expected that keyring-path would affect which file was written to.

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: python-keyring 0.7.1-1fakesync1 [modified: usr/share/pyshared/keyring/core.py]
ProcVersionSignature: User Name 3.2.0-25.40-virtual 3.2.18
Uname: Linux 3.2.0-25-virtual x86_64
ApportVersion: 2.0.1-0ubuntu8
Architecture: amd64
Date: Wed Jul 11 14:18:38 2012
PackageArchitecture: all
ProcEnviron:
 TERM=screen
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: python-keyring
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
Scott Moser (smoser) wrote :
summary: - UncryptedFileKeyring creates ~/keyring_pass.cfg world readable
+ UncryptedFileKeyring creates ~/keyring_pass.cfg world readable, ignores
+ keyring-path
Changed in python-keyring (Ubuntu):
importance: Undecided → High
Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

http://www.ubuntu.com/usn/usn-1634-1/ updated python-keyring to a newer version, which now stores keyrings in a sane location, with secure permissions. Could you see if it solves the problems you were having?

Changed in python-keyring (Ubuntu):
status: New → Incomplete
Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for python-keyring (Ubuntu) because there has been no activity for 60 days.]

Changed in python-keyring (Ubuntu):
status: Incomplete → Expired
Scott Moser (smoser)
Changed in python-keyring (Ubuntu):
status: Expired → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.