diff options
| author | Jakub Hrozek <jhrozek@redhat.com> | 2013-09-16 17:02:39 +0200 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2013-09-17 19:42:58 +0200 |
| commit | 11a044514e3799c4e685cf98ed5c058aa02b5fdb (patch) | |
| tree | 302f2f2df42b75173100b588c7fd927701226faf /src | |
| parent | a21ccb89b573901abdc3bd921c1e6f2650450961 (diff) | |
| download | sssd-11a044514e3799c4e685cf98ed5c058aa02b5fdb.tar.gz sssd-11a044514e3799c4e685cf98ed5c058aa02b5fdb.tar.bz2 sssd-11a044514e3799c4e685cf98ed5c058aa02b5fdb.zip | |
KRB5: Call umask before mkstemp in the krb5 child code
Diffstat (limited to 'src')
| -rw-r--r-- | src/providers/krb5/krb5_child.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c index f896332d..032f5020 100644 --- a/src/providers/krb5/krb5_child.c +++ b/src/providers/krb5/krb5_child.c @@ -439,6 +439,7 @@ static errno_t handle_randomized(char *in) char *ccname = NULL; int ret; int fd; + mode_t old_umask; /* We only treat the FILE type case in a special way due to the history * of storing FILE type ccache in /tmp and associated security issues */ @@ -460,7 +461,9 @@ static errno_t handle_randomized(char *in) * something races, we mostly care only about not accidentally use * an existing name and thus failing in the process of saving the * cache. Malicious races can only be avoided by libkrb5 itself. */ + old_umask = umask(077); fd = mkstemp(ccname); + umask(old_umask); if (fd == -1) { ret = errno; DEBUG(SSSDBG_CRIT_FAILURE, ("mkstemp(\"%s\") failed!\n", ccname)); |