rubygems/rubygems — Issue #272: Gem does not reset permissions when building packages.
Author: envygeeks
Created: 2012-02-01 16:19:37+00:00
State: open

Normally for security on our systems we default permissions for everything in home to og-rwx, however I noticed today when I installed one of my gems that it kept those permissions even after the build so when the gem was installed via rubygems.org nobody but root could access said gem. I propose that permissions are not preserved when building a package and that rubygems builds a default permission set of u+rwx,og+rw-x (0744).