diff options
| author | Petr Cech <pcech@redhat.com> | 2015-10-06 07:57:17 -0400 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2015-10-14 13:27:21 +0200 |
| commit | a0ad4f2a4a342214acd4ab4b77cc5ccce22b35ad (patch) | |
| tree | 27435de0e6cdfdd15b34383ffdf1071a8eaa26e8 | |
| parent | ae627e216689b0a5834f36aaaa007ed584ef033d (diff) | |
| download | sssd-a0ad4f2a4a342214acd4ab4b77cc5ccce22b35ad.tar.gz sssd-a0ad4f2a4a342214acd4ab4b77cc5ccce22b35ad.tar.xz sssd-a0ad4f2a4a342214acd4ab4b77cc5ccce22b35ad.zip | |
UTILS: More restrictive permissions in domain_info
There are two occurances of creating temp. file under SSS_DFL_X_UMASK
permissions which enable possibility to grant executable permission.
After writting to those temp. files, they are renamed and they
get 0644 permissions. So SSS_DFL_UMASK is good enough fot this case.
Resolves:
https://fedorahosted.org/sssd/ticket/2424
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
| -rw-r--r-- | src/util/domain_info_utils.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/util/domain_info_utils.c b/src/util/domain_info_utils.c index 04e7d08d5..baed132ce 100644 --- a/src/util/domain_info_utils.c +++ b/src/util/domain_info_utils.c @@ -312,7 +312,7 @@ sss_write_domain_mappings(struct sss_domain_info *domain) goto done; } - old_mode = umask(SSS_DFL_X_UMASK); + old_mode = umask(SSS_DFL_UMASK); fd = mkstemp(tmp_file); umask(old_mode); if (fd < 0) { @@ -562,7 +562,7 @@ static errno_t sss_write_krb5_localauth_snippet(const char *path) goto done; } - old_mode = umask(SSS_DFL_X_UMASK); + old_mode = umask(SSS_DFL_UMASK); fd = mkstemp(tmp_file); umask(old_mode); if (fd < 0) { |