summaryrefslogtreecommitdiffstats
path: root/src/providers/krb5
diff options
context:
space:
mode:
authorStephen Gallagher <sgallagh@redhat.com>2011-12-16 11:13:55 -0500
committerStephen Gallagher <sgallagh@redhat.com>2011-12-19 11:38:35 -0500
commit69420a154fc9fb8b04f437125a6a0604b26b1292 (patch)
tree4b8e118a394baa2cc0ceeaeadbd04d12db973ef7 /src/providers/krb5
parent05113318e280904f2a1ce3721b8d6504afd7e7df (diff)
downloadsssd-69420a154fc9fb8b04f437125a6a0604b26b1292.tar.gz
sssd-69420a154fc9fb8b04f437125a6a0604b26b1292.tar.xz
sssd-69420a154fc9fb8b04f437125a6a0604b26b1292.zip
Securely set umask when using mkstemp
Coverity 12394, 12395, 12396, 12397 and 12398
Diffstat (limited to 'src/providers/krb5')
-rw-r--r--src/providers/krb5/krb5_child.c3
-rw-r--r--src/providers/krb5/krb5_common.c3
2 files changed, 6 insertions, 0 deletions
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index 01690cf4a..297e3a763 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -230,6 +230,7 @@ static krb5_error_code create_ccache_file(krb5_context ctx,
char *tmp_ccname;
krb5_creds *l_cred;
TALLOC_CTX *tmp_ctx = NULL;
+ mode_t old_umask;
if (strncmp(ccname, "FILE:", 5) == 0) {
cc_file_name = ccname + 5;
@@ -258,7 +259,9 @@ static krb5_error_code create_ccache_file(krb5_context ctx,
}
tmp_ccname = talloc_asprintf_append(tmp_ccname, "/.krb5cc_dummy_XXXXXX");
+ old_umask = umask(077);
fd = mkstemp(tmp_ccname);
+ umask(old_umask);
if (fd == -1) {
DEBUG(1, ("mkstemp failed [%d][%s].\n", errno, strerror(errno)));
kerr = errno;
diff --git a/src/providers/krb5/krb5_common.c b/src/providers/krb5/krb5_common.c
index a065727a7..c2cb94b61 100644
--- a/src/providers/krb5/krb5_common.c
+++ b/src/providers/krb5/krb5_common.c
@@ -290,6 +290,7 @@ errno_t write_krb5info_file(const char *realm, const char *server,
const char *name_tmpl = NULL;
int server_len;
ssize_t written;
+ mode_t old_umask;
if (realm == NULL || *realm == '\0' || server == NULL || *server == '\0' ||
service == NULL || service == '\0') {
@@ -328,7 +329,9 @@ errno_t write_krb5info_file(const char *realm, const char *server,
goto done;
}
+ old_umask = umask(077);
fd = mkstemp(tmp_name);
+ umask(old_umask);
if (fd == -1) {
ret = errno;
DEBUG(1, ("mkstemp failed [%d][%s].\n", ret, strerror(ret)));