summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJakub Hrozek <jhrozek@redhat.com>2015-08-05 17:25:20 +0200
committerJakub Hrozek <jhrozek@redhat.com>2015-08-17 14:02:59 +0200
commit13f30f69eec02d0c0aaccc7b544dee1326a5e9d4 (patch)
tree3a6265e896314eb08d2fc1b02b888c3313dfe28f
parent6fd5306145d98ea3bab7f32aa66475f610f388ce (diff)
downloadsssd-13f30f69eec02d0c0aaccc7b544dee1326a5e9d4.tar.gz
sssd-13f30f69eec02d0c0aaccc7b544dee1326a5e9d4.tar.xz
sssd-13f30f69eec02d0c0aaccc7b544dee1326a5e9d4.zip
p11child: set restrictive umask and clear environment
https://fedorahosted.org/sssd/ticket/2754 Before doing any calls, set a very restrictive umask and clear environment variables to harden p11child execution. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
-rw-r--r--src/p11_child/p11_child_nss.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/src/p11_child/p11_child_nss.c b/src/p11_child/p11_child_nss.c
index 6948c142a..44ba66788 100644
--- a/src/p11_child/p11_child_nss.c
+++ b/src/p11_child/p11_child_nss.c
@@ -481,6 +481,9 @@ int main(int argc, const char *argv[])
/* Set debug level to invalid value so we can decide if -d 0 was used. */
debug_level = SSSDBG_INVALID;
+ clearenv();
+ umask(077);
+
pc = poptGetContext(argv[0], argc, argv, long_options, 0);
while ((opt = poptGetNextOpt(pc)) != -1) {
switch(opt) {