3 files changed, 29 insertions, 16 deletions

diff --git a/src/shared/ask-password-api.c b/src/shared/ask-password-api.c
index 85530660dc..277efd302e 100644
--- a/src/shared/ask-password-api.c
+++ b/src/shared/ask-password-api.c
@@ -251,7 +251,6 @@ static int create_socket(char **name) {
         } sa;
         int one = 1, r;
         char *c;
-        mode_t u;
 
         assert(name);
 
@@ -265,9 +264,9 @@ static int create_socket(char **name) {
         sa.un.sun_family = AF_UNIX;
         snprintf(sa.un.sun_path, sizeof(sa.un.sun_path)-1, "/run/systemd/ask-password/sck.%llu", random_ull());
 
-        u = umask(0177);
-        r = bind(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
-        umask(u);
+        RUN_WITH_UMASK(0177) {
+                r = bind(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
+        }
 
         if (r < 0) {
                 r = -errno;
@@ -317,7 +316,6 @@ int ask_password_agent(
         int socket_fd = -1, signal_fd = -1;
         sigset_t mask, oldmask;
         struct pollfd pollfd[_FD_MAX];
-        mode_t u;
 
         assert(_passphrases);
 
@@ -327,9 +325,9 @@ int ask_password_agent(
 
         mkdir_p_label("/run/systemd/ask-password", 0755);
 
-        u = umask(0022);
-        fd = mkostemp(temp, O_CLOEXEC|O_CREAT|O_WRONLY);
-        umask(u);
+        RUN_WITH_UMASK(0022) {
+                fd = mkostemp(temp, O_CLOEXEC|O_CREAT|O_WRONLY);
+        }
 
         if (fd < 0) {
                 log_error("Failed to create password file: %m");
diff --git a/src/shared/util.c b/src/shared/util.c
index d861ca9f09..1bffd84d1f 100644
--- a/src/shared/util.c
+++ b/src/shared/util.c
@@ -5732,12 +5732,12 @@ int search_and_fopen_nulstr(const char *path, const char *mode, const char *sear
 int create_tmp_dir(char template[], char** dir_name) {
         int r = 0;
         char *d, *dt;
-        mode_t _cleanup_umask_ u;
 
         assert(dir_name);
 
-        u = umask(0077);
-        d = mkdtemp(template);
+        RUN_WITH_UMASK(0077) {
+                d = mkdtemp(template);
+        }
         if (!d) {
                 log_error("Can't create directory %s: %m", template);
                 return -errno;
@@ -5749,9 +5749,10 @@ int create_tmp_dir(char template[], char** dir_name) {
                 goto fail3;
         }
 
-        umask(0000);
-        r = mkdir(dt, 0777);
-        if (r) {
+        RUN_WITH_UMASK(0000) {
+                r = mkdir(dt, 0777);
+        }
+        if (r < 0) {
                 log_error("Can't create directory %s: %m", dt);
                 r = -errno;
                 goto fail2;
diff --git a/src/shared/util.h b/src/shared/util.h
index 7f050758a0..69a47653aa 100644
--- a/src/shared/util.h
+++ b/src/shared/util.h
@@ -616,8 +616,22 @@ char *strrep(const char *s, unsigned n);
 
 void* greedy_realloc(void **p, size_t *allocated, size_t need);
 
-static inline void reset_errno(int *saved_errno) {
+static inline void _reset_errno_(int *saved_errno) {
         errno = *saved_errno;
 }
 
-#define PROTECT_ERRNO __attribute__((cleanup(reset_errno))) int _saved_errno_ = errno
+#define PROTECT_ERRNO __attribute__((cleanup(_reset_errno_))) int _saved_errno_ = errno
+
+struct umask_struct {
+        mode_t mask;
+        bool quit;
+};
+
+static inline void _reset_umask_(struct umask_struct *s) {
+        umask(s->mask);
+};
+
+#define RUN_WITH_UMASK(mask)                                            \
+        for (__attribute__((cleanup(_reset_umask_))) struct umask_struct _saved_umask_ = { umask(mask), false }; \
+             !_saved_umask_.quit ;                                      \
+             _saved_umask_.quit = true)