From 4023fb832cc5c5122c235b713c0ef401c5d21dd0 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Wed, 5 Aug 2015 17:25:20 +0200
Subject: p11child: set restrictive umask and clear environment

https://fedorahosted.org/sssd/ticket/2754

Before doing any calls, set a very restrictive umask and clear
environment variables to harden p11child execution.
---
 src/p11_child/p11_child_nss.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/p11_child/p11_child_nss.c b/src/p11_child/p11_child_nss.c
index 6948c142a..44ba66788 100644
--- a/src/p11_child/p11_child_nss.c
+++ b/src/p11_child/p11_child_nss.c
@@ -481,6 +481,9 @@ int main(int argc, const char *argv[])
     /* Set debug level to invalid value so we can decide if -d 0 was used. */
     debug_level = SSSDBG_INVALID;
 
+    clearenv();
+    umask(077);
+
     pc = poptGetContext(argv[0], argc, argv, long_options, 0);
     while ((opt = poptGetNextOpt(pc)) != -1) {
         switch(opt) {
-- 
cgit