bug#45245: 28.0.50; Feature request: tramp sudo autosaves/backups shouldn't be exposed without right config

[Michael Albinus]

Vandrus Zoltán <vandrus.zoltan@gmail.com> writes:

Hi Zoltán,

> It's mentioned in (tramp)Auto-save and Backup that root owned file
> could be exposed, but it would be more newbie friendly if emacs did
> the right thing without configuration. The defaults for backups are
> fine, but for autosaves are not. In emacs -Q after:
>
> C-x C-f /sudo::/tmp/secretfile
> M-x do-auto-save
>
> There is a file '/tmp/#!sudo:root@hostname:!tmp!secretfile#' owned by
> the user.
>
> Even if the defaults are fixed, there are problems. Protecting root
> owned files is somewhat complicated. For example the user might not
> use tramp from the beginning, but littering directories with backups
> and autosaves files are easily seen and can be annoying enough to look
> for a solution. Looking on the net the suggested code is some variant
> of
>
>     (setq auto-save-file-name-transforms
>           '((".*" ,auto-save-dir t)))
>
>     (setq backup-directory-alist
>          '("." ,backup-dir))
>
> And then they are fine, until they start to use tramp, because the
> autosaves/backups will be owned by the normal user even for sudo and
> su methods.
> For backups following the tramp manual is easy:
>
>      (customize-set-variable
>       'tramp-backup-directory-alist backup-directory-alist)
>
> But the user could have forgotten already about the problem and never
> look there. For autosaves there is not even info on how to achieve
> something sensible.
>
> I suggest, that tramp could refuse exposing root-owned files or there
> could be an easier switch to put all autosaves/backup in the same
> directory which also deals with tramp.
>
> There is also a comparably minor problem of exposing the file name in
> the autosave files.

Finally, I've found the time to work on the problem. I've pushed a patch
to master, that Tramp asks for confirmation for the first time a
root-owned auto-save or backup file name is to be written to the local
temporary directory. This is the most common case to handle.

See also the Tramp manual patch about.

Best regards, Michael.