summaryrefslogtreecommitdiff
path: root/src/providers/krb5
diff options
context:
space:
mode:
authorJakub Hrozek <jhrozek@redhat.com>2013-09-16 17:02:39 +0200
committerJakub Hrozek <jhrozek@redhat.com>2013-09-17 19:42:58 +0200
commit11a044514e3799c4e685cf98ed5c058aa02b5fdb (patch)
tree302f2f2df42b75173100b588c7fd927701226faf /src/providers/krb5
parenta21ccb89b573901abdc3bd921c1e6f2650450961 (diff)
downloadsssd-11a044514e3799c4e685cf98ed5c058aa02b5fdb.tar.gz
sssd-11a044514e3799c4e685cf98ed5c058aa02b5fdb.tar.bz2
sssd-11a044514e3799c4e685cf98ed5c058aa02b5fdb.zip
KRB5: Call umask before mkstemp in the krb5 child code
Diffstat (limited to 'src/providers/krb5')
-rw-r--r--src/providers/krb5/krb5_child.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index f896332d..032f5020 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -439,6 +439,7 @@ static errno_t handle_randomized(char *in)
char *ccname = NULL;
int ret;
int fd;
+ mode_t old_umask;
/* We only treat the FILE type case in a special way due to the history
* of storing FILE type ccache in /tmp and associated security issues */
@@ -460,7 +461,9 @@ static errno_t handle_randomized(char *in)
* something races, we mostly care only about not accidentally use
* an existing name and thus failing in the process of saving the
* cache. Malicious races can only be avoided by libkrb5 itself. */
+ old_umask = umask(077);
fd = mkstemp(ccname);
+ umask(old_umask);
if (fd == -1) {
ret = errno;
DEBUG(SSSDBG_CRIT_FAILURE, ("mkstemp(\"%s\") failed!\n", ccname));