229621 - Mozilla is able to overwrite bookmarks.html / prefs.js / etc. of different owner

Status: RESOLVED INVALID

(Core :: Security, defect)

Description

[Max Alekseyev]

Linux build 2003122707

To reproduce:
1. Change permissions of bookmarks.html in user's profile directory to
-rw-------    1 root     root
2. Run Mozilla with a normal user permissions
3. Exit Mozilla
4. Observe that Mozilla has overwritten bookmarks.html with default one
disregarding file permissions.

This bug seems quite artificial but potentially may lead to some malicious
Mozilla use, e.g. for removing some other user's bookmarks.html etc. 
Mozilla definitely must obey file permissions!

Comment 1

[Jerry Talkington]

Moz is not disregarding file perms (in fact, there is no way to bypass file
system perms.)  The filesystem allows you to delete the file, since the
directory is still owned by the original user (you can't read it, however.)  You
can do this on the command line also.

The user's profile directory stuff is meant to be overwritten, so this is
working as designed.  This bug should be closed, unless the OR wants to change
this to an enhancement request to not remove bookmarks that are owned by other
users...

Comment 2

[Max Alekseyev]

Oh, you're right. Marking as INVALID.
Request to not remove bookmarks that are owned by other users looks quite
artificial. 
I mostly care about bug 229619 that causes change of bookmarks.html owner.