summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2011-08-01 22:42:07 +0200
committerLennart Poettering <lennart@poettering.net>2011-08-01 22:42:07 +0200
commit1d6702e8d3877c0bebf3ac817dc45ff72f5ecfa9 (patch)
tree2a40e6fff9a9aa6cde706bba5250b149bce519c5 /src
parent260d370833ba5449f77d4184a8eb80e5501be900 (diff)
umask: set umask of a number of sockets by default, even though we check creds on connections
Diffstat (limited to 'src')
-rw-r--r--src/ask-password-api.c14
-rw-r--r--src/manager.c9
2 files changed, 19 insertions, 4 deletions
diff --git a/src/ask-password-api.c b/src/ask-password-api.c
index 04d5623d9e..f57105c132 100644
--- a/src/ask-password-api.c
+++ b/src/ask-password-api.c
@@ -250,6 +250,7 @@ static int create_socket(char **name) {
} sa;
int one = 1, r;
char *c;
+ mode_t u;
assert(name);
@@ -262,7 +263,11 @@ static int create_socket(char **name) {
sa.un.sun_family = AF_UNIX;
snprintf(sa.un.sun_path, sizeof(sa.un.sun_path)-1, "/run/systemd/ask-password/sck.%llu", random_ull());
- if (bind(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path)) < 0) {
+ u = umask(0177);
+ r = bind(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
+ umask(u);
+
+ if (r < 0) {
r = -errno;
log_error("bind() failed: %m");
goto fail;
@@ -310,6 +315,7 @@ int ask_password_agent(
int socket_fd = -1, signal_fd = -1;
sigset_t mask, oldmask;
struct pollfd pollfd[_FD_MAX];
+ mode_t u;
assert(_passphrases);
@@ -319,7 +325,11 @@ int ask_password_agent(
mkdir_p("/run/systemd/ask-password", 0755);
- if ((fd = mkostemp(temp, O_CLOEXEC|O_CREAT|O_WRONLY)) < 0) {
+ u = umask(0022);
+ fd = mkostemp(temp, O_CLOEXEC|O_CREAT|O_WRONLY);
+ umask(u);
+
+ if (fd < 0) {
log_error("Failed to create password file: %m");
r = -errno;
goto finish;
diff --git a/src/manager.c b/src/manager.c
index 69dbec4347..a189479b36 100644
--- a/src/manager.c
+++ b/src/manager.c
@@ -76,7 +76,8 @@ static int manager_setup_notify(Manager *m) {
struct sockaddr_un un;
} sa;
struct epoll_event ev;
- int one = 1;
+ int one = 1, r;
+ mode_t u;
assert(m);
@@ -99,7 +100,11 @@ static int manager_setup_notify(Manager *m) {
if (sa.un.sun_path[0] == '@')
sa.un.sun_path[0] = 0;
- if (bind(m->notify_watch.fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + 1 + strlen(sa.un.sun_path+1)) < 0) {
+ u = umask(0111);
+ r = bind(m->notify_watch.fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + 1 + strlen(sa.un.sun_path+1));
+ umask(u);
+
+ if (r < 0) {
log_error("bind() failed: %m");
return -errno;
}