include::../description.adoc[]

include::../ask-yourself.adoc[]

include::../recommended.adoc[]

== Sensitive Code Example

When creating a file or directory with permissions to "other group":

----
open("myfile.txt", O_CREAT, S_IRWXU | S_IRWXG | S_IRWXO); // Sensitive: the process set 777 permissions to this newly created file

mkdir("myfolder", S_IRWXU | S_IRWXG | S_IRWXO); // Sensitive: the process try to set 777 permissions to this newly created directory
----

When explicitly adding permissions to "other group" with ``++chmod++``, ``++fchmod++`` or ``++filesystem::permissions++`` functions:

----
chmod("myfile.txt", S_IRWXU | S_IRWXG | S_IRWXO);  // Sensitive: the process set 777 permissions to this file

fchmod(fd, S_IRWXU | S_IRWXG | S_IRWXO); // Sensitive: the process set 777 permissions to this file descriptor
----

When defining the ``++umask++`` without read, write and execute permissions for "other group":

----
umask(S_IRWXU | S_IRWXG); // Sensitive: the further files and folders will be created with possible permissions to "other group"
----

== Compliant Solution

When creating a file or directory, do not set permissions to "other group":

----
open("myfile.txt", O_CREAT, S_IRWXU | S_IRWXG); // Compliant

mkdir("myfolder", S_IRWXU | S_IRWXG); // Compliant
----

When using ``++chmod++``, ``++fchmod++`` or ``++filesystem::permissions++`` functions, do not add permissions to "other group":

----
chmod("myfile.txt", S_IRWXU | S_IRWXG);  // Compliant

fchmod(fd, S_IRWXU | S_IRWXG); // Compliant
----

When defining the ``++umask++``, set read, write and execute permissions to other group:

----
umask(S_IRWXO); // Compliant: further created files or directories will not have permissions set for "other group"
----

include::../see.adoc[]

ifdef::env-github,rspecator-view[]
'''
== Comments And Links
(visible only on this page)

include::comments-and-links.adoc[]
endif::env-github,rspecator-view[]
