{"id":8009,"date":"2026-09-16T11:17:34","date_gmt":"2026-09-16T08:17:34","guid":{"rendered":"https:\/\/mummila.net\/kommentit\/?p=8009"},"modified":"2026-09-16T11:17:34","modified_gmt":"2026-09-16T08:17:34","slug":"files-in-release-tarballs-are-world-writable","status":"publish","type":"post","link":"https:\/\/mummila.net\/kommentit\/2026\/09\/16\/files-in-release-tarballs-are-world-writable\/","title":{"rendered":"Files in release tarballs are world-writable"},"content":{"rendered":"

Mattermost Server Version<\/h3>\n

11.10.2<\/p>\n

Operating System<\/h3>\n

Ubuntu 26.04 (and probably any other Unix-like OS)<\/p>\n

Steps to reproduce<\/h3>\n
    \n
  1. wget\u00a0https:\/\/releases.mattermost.com\/11.11.0\/mattermost-11.11.0-linux-amd64.tar.gz<\/a>\u00a0# current latest<\/li>\n
  2. tar tvf mattermost-11.11.0-linux-amd64.tar.gz | head<\/li>\n<\/ol>\n

    Expected behavior<\/h3>\n
    drwxrwxr-x root\/root         0 2026-09-11 08:52 mattermost\/\r\ndrwxrwxr-x root\/root         0 2026-09-11 08:52 mattermost\/prepackaged_plugins\/\r\n-rw-rw-r-- root\/root  32570767 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-calls-v1.12.2-linux-amd64.tar.gz\r\n-rw-rw-r-- root\/root       566 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-calls-v1.12.2-linux-amd64.tar.gz.sig\r\n-rw-rw-r-- root\/root  15900090 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-github-v2.7.1-linux-amd64.tar.gz\r\n-rw-rw-r-- root\/root       566 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-github-v2.7.1-linux-amd64.tar.gz.sig\r\n-rw-rw-r-- root\/root  16578584 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-gitlab-v1.13.0-linux-amd64.tar.gz\r\n-rw-rw-r-- root\/root       566 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-gitlab-v1.13.0-linux-amd64.tar.gz.sig\r\n-rw-rw-r-- root\/root   9828026 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-jira-v4.7.1-linux-amd64.tar.gz\r\n-rw-rw-r-- root\/root       566 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-jira-v4.7.1-linux-amd64.tar.gz.sig\r\n<\/code><\/pre>\n
    Observed behavior<\/h3>\n
    drwxrwxrwx root\/root         0 2026-09-11 08:52 mattermost\/\r\ndrwxrwxrwx root\/root         0 2026-09-11 08:52 mattermost\/prepackaged_plugins\/\r\n-rw-rw-rw- root\/root  32570767 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-calls-v1.12.2-linux-amd64.tar.gz\r\n-rw-rw-rw- root\/root       566 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-calls-v1.12.2-linux-amd64.tar.gz.sig\r\n-rw-rw-rw- root\/root  15900090 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-github-v2.7.1-linux-amd64.tar.gz\r\n-rw-rw-rw- root\/root       566 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-github-v2.7.1-linux-amd64.tar.gz.sig\r\n-rw-rw-rw- root\/root  16578584 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-gitlab-v1.13.0-linux-amd64.tar.gz\r\n-rw-rw-rw- root\/root       566 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-gitlab-v1.13.0-linux-amd64.tar.gz.sig\r\n-rw-rw-rw- root\/root   9828026 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-jira-v4.7.1-linux-amd64.tar.gz\r\n-rw-rw-rw- root\/root       566 2026-09-11 08:52 mattermost\/prepackaged_plugins\/mattermost-plugin-jira-v4.7.1-linux-amd64.tar.gz.sig\r\n<\/code><\/pre>\n
    Additional Information<\/h3>\n
    The\u00a0installation instructions<\/a>\u00a0suggest extracting the files as non-root, which will result in the user’s umask being applied to the output files, so that’ll cause the world-writablity bit to get dropped (hopefully for most users).<\/p>\n
    It’d still be better though if the files were 0660\/0770 (or at least 0664\/0775) even when extracted as root. (Group-writability is enforced by the instructions’\u00a0sudo chmod -R g+w \/opt\/mattermost<\/code>\u00a0in any case.)<\/p>\n","protected":false},"excerpt":{"rendered":"
    Extracting the files as non-root will apply umask, so that’ll cause the world-writablity bit to get dropped (hopefully for most users).<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8860],"tags":[14049,2641,12437],"class_list":["post-8009","post","type-post","status-publish","format-standard","hentry","category-vianhallintajarjestelmat","tag-mattermost","tag-turvallisuus","tag-unix","sijainti-github"],"_links":{"self":[{"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/posts\/8009","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/comments?post=8009"}],"version-history":[{"count":1,"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/posts\/8009\/revisions"}],"predecessor-version":[{"id":8010,"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/posts\/8009\/revisions\/8010"}],"wp:attachment":[{"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/media?parent=8009"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/categories?post=8009"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mummila.net\/kommentit\/wp-json\/wp\/v2\/tags?post=8009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}