diff options
| -rw-r--r-- | TODO | 3 | ||||
| -rw-r--r-- | src/ask-password-api.c | 14 | ||||
| -rw-r--r-- | src/manager.c | 9 | ||||
| -rw-r--r-- | units/systemd-shutdownd.socket | 1 |
4 files changed, 23 insertions, 4 deletions
@@ -19,6 +19,9 @@ Bugfixes: Features: +* allow Type=simple with PIDFile= + https://bugzilla.redhat.com/show_bug.cgi?id=723942 + * generator dir is 666? * set access mode of /run/systemd/{private,notify} to 666, not 777 diff --git a/src/ask-password-api.c b/src/ask-password-api.c index 04d5623d9e..f57105c132 100644 --- a/src/ask-password-api.c +++ b/src/ask-password-api.c @@ -250,6 +250,7 @@ static int create_socket(char **name) { } sa; int one = 1, r; char *c; + mode_t u; assert(name); @@ -262,7 +263,11 @@ static int create_socket(char **name) { sa.un.sun_family = AF_UNIX; snprintf(sa.un.sun_path, sizeof(sa.un.sun_path)-1, "/run/systemd/ask-password/sck.%llu", random_ull()); - if (bind(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path)) < 0) { + u = umask(0177); + r = bind(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path)); + umask(u); + + if (r < 0) { r = -errno; log_error("bind() failed: %m"); goto fail; @@ -310,6 +315,7 @@ int ask_password_agent( int socket_fd = -1, signal_fd = -1; sigset_t mask, oldmask; struct pollfd pollfd[_FD_MAX]; + mode_t u; assert(_passphrases); @@ -319,7 +325,11 @@ int ask_password_agent( mkdir_p("/run/systemd/ask-password", 0755); - if ((fd = mkostemp(temp, O_CLOEXEC|O_CREAT|O_WRONLY)) < 0) { + u = umask(0022); + fd = mkostemp(temp, O_CLOEXEC|O_CREAT|O_WRONLY); + umask(u); + + if (fd < 0) { log_error("Failed to create password file: %m"); r = -errno; goto finish; diff --git a/src/manager.c b/src/manager.c index 69dbec4347..a189479b36 100644 --- a/src/manager.c +++ b/src/manager.c @@ -76,7 +76,8 @@ static int manager_setup_notify(Manager *m) { struct sockaddr_un un; } sa; struct epoll_event ev; - int one = 1; + int one = 1, r; + mode_t u; assert(m); @@ -99,7 +100,11 @@ static int manager_setup_notify(Manager *m) { if (sa.un.sun_path[0] == '@') sa.un.sun_path[0] = 0; - if (bind(m->notify_watch.fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + 1 + strlen(sa.un.sun_path+1)) < 0) { + u = umask(0111); + r = bind(m->notify_watch.fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + 1 + strlen(sa.un.sun_path+1)); + umask(u); + + if (r < 0) { log_error("bind() failed: %m"); return -errno; } diff --git a/units/systemd-shutdownd.socket b/units/systemd-shutdownd.socket index b30a6657cf..bc0358a346 100644 --- a/units/systemd-shutdownd.socket +++ b/units/systemd-shutdownd.socket @@ -14,3 +14,4 @@ Before=sockets.target [Socket] ListenDatagram=/run/systemd/shutdownd +SocketMode=0600 |