Bug 441957

Summary:	kleopatra: Creates unsafe ~/.gnupg when not already present
Product:	[Applications] kleopatra	Reporter:	Rex Dieter <rdieter>
Component:	general	Assignee:	Andre Heinecke <aheinecke>
Status:	RESOLVED FIXED
Severity:	normal	CC:	kloecker, mutz, norbert, pim-bugs-null
Priority:	NOR
Version First Reported In:	3.1.12
Target Milestone:	---
Platform:	Other
OS:	Linux
Latest Commit:	16073f7e4fa7fb6e0424fb641f70d28d47adc660	Version Fixed/Implemented In:	21.08.2
Sentry Crash Report:

Description Rex Dieter 2021-09-03 17:52:58 UTC

Tested with:
$ kleopatra --version
kleopatra 3.1.12 (20.12.2)

on fedora 34.  Received downstream report,
"kleopatra: Creates unsafe ~/.gnupg when not already present"
https://bugzilla.redhat.com/show_bug.cgi?id=2000292

That I think I have confirmed.

If you let gpg2 (and friends) create a fresh ~/.gnupg , ownership/perms as such:
$ gpg2
gpg: directory '/home/rdieter/.gnupg' created
gpg: keybox '/home/rdieter/.gnupg/pubring.kbx' created
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
gpg: Go ahead and type your message ...

$ ls -ld ~/.gnupg
drwx------. 1 rdieter rdieter 92 Sep  3 12:51 /home/rdieter/.gnupg

But if that dir doesn't exist and I start kleopatra, I end up with:
$ ls -ld ~/.gnupg*
drwxrwxr-x. 1 rdieter rdieter 98 Sep  3 12:28 /home/rdieter/.gnupg

Comment 1 Norbert Preining 2021-09-21 00:15:42 UTC

Same on Debian, and same with 20.12 - 21.04 - 21.08

Comment 2 Andre Heinecke 2021-09-23 08:26:30 UTC

Thanks for the report. We were able to reproduce it and have fixed this.