Re: [BUG] svn:executable has bad security implications.

On Tue, Mar 09, 2004 at 03:58:58PM -0500, Greg Hudson wrote:
> On Tue, 2004-03-09 at 15:35, Ben Reser wrote:
> > Unfortunately APR doesn't provide us a good way to deal with this. It
> > doesn't provide a way to get the umask. Nor does it provide a way to
> > set perms while respecting the umask.
>
> Could we set the x bits corresponding to the already-set r bits,
> perhaps? That seems safe, and shouldn't require any APR hackery.

This would I suppose give us the effect of making a reasonably safe bet.
We're still going to need to try apr_file_perms_set and then fallback to
apr_file_attrs_set. The latter always sets a+x if you ask it to set an
executeable attribute.

-- 
Ben Reser <ben@reser.org>
http://ben.reser.org
"Conscience is the inner voice which warns us somebody may be looking."
- H.L. Mencken
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org