From: Maximiliano Sandoval <m.sandoval@proxmox.com>
To: Thomas Lamprecht <t.lamprecht@proxmox.com>
Cc: Proxmox VE development discussion <pve-devel@lists.proxmox.com>
Subject: [pve-devel] superseded: [PATCH storage v2] fix #5181: pbs: store and read passwords as unicode
Date: Wed, 30 Jul 2025 09:25:11 +0200 [thread overview]
Message-ID: <s8owm7q16p4.fsf@proxmox.com> (raw)
In-Reply-To: <b5073f61-6163-4c0e-b9e4-24ec097f460c@proxmox.com> (Thomas Lamprecht's message of "Tue, 29 Jul 2025 18:10:40 +0200")
Thomas Lamprecht <t.lamprecht@proxmox.com> writes:
> Am 23.07.25 um 15:00 schrieb Shannon Sterz:
>> -->8 snip 8<--
>>> - PVE::Tools::file_set_contents($pwfile, "$password\n");
>>> + PVE::Tools::file_set_contents($pwfile, "$password\n", undef, 1);
>> i know this is pre-existing, but i'd feel more comfortable forcing the
>> permissions here rather than depending on the default behaviour. this is
>> a password file after all, being explicit doesn't hurt in my opinion.
>
> FWIW, as this file resides in /etc/pve/priv the permissions are enforced
> to 0600 by pmxcfs already, and the 0644 default from file_set_contents
> would have been problematic in any case already.
>
> Passing 0600 explicitly here might still not hurt though, and potentially
> even help, e.g. if one copies this over for some other secret that is e.g.
> node local and thinks this is secure as is, not very likely, but the cost
> of doing this is way to to small compared with potential impact.
v3 send at https://lore.proxmox.com/pve-devel/20250730072239.24928-1-m.sandoval@proxmox.com.
--
Maximiliano
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
prev parent reply other threads:[~2025-07-30 7:23 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-13 13:11 [pve-devel] " Maximiliano Sandoval
2025-06-13 13:11 ` Maximiliano Sandoval
2025-07-23 13:00 ` Shannon Sterz
2025-07-29 16:10 ` Thomas Lamprecht
2025-07-30 7:25 ` Maximiliano Sandoval [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=s8owm7q16p4.fsf@proxmox.com \
--to=m.sandoval@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
--cc=t.lamprecht@proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox