From 7c30e5abf469134253d5bdec29cda7b47c41ca3e Mon Sep 17 00:00:00 2001

From: Pavel Reichl <preichl@redhat.com>

Date: Fri, 24 Oct 2014 12:42:50 +0100

Subject: [PATCH 46/46] RESPONDERS: Set default value for umask

Resolves: https://fedorahosted.org/sssd/ticket/2468

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

(cherry picked from commit 458f5245dd5130d12666cce6faf8ef1ec7f80169)

---

 src/responder/autofs/autofssrv.c | 2 ++

 src/responder/common/responder.h | 4 ++++

 src/responder/ifp/ifpsrv.c       | 2 ++

 src/responder/nss/nsssrv.c       | 2 ++

 src/responder/pac/pacsrv.c       | 2 ++

 src/responder/pam/pamsrv.c       | 2 ++

 src/responder/ssh/sshsrv.c       | 2 ++

 src/responder/sudo/sudosrv.c     | 2 ++

 8 files changed, 18 insertions(+)

diff --git a/src/responder/autofs/autofssrv.c b/src/responder/autofs/autofssrv.c

index 44474ee0858d92fb5965de07773e3ad1e020ebfd..91f529135e9bd74a5cf89edadd98fb2368630b5e 100644

--- a/src/responder/autofs/autofssrv.c

+++ b/src/responder/autofs/autofssrv.c

@@ -220,6 +220,8 @@ int main(int argc, const char *argv[])

     /* Set debug level to invalid value so we can decide if -d 0 was used. */

     debug_level = SSSDBG_INVALID;

+    umask(DFL_RSP_UMASK);

+

     pc = poptGetContext(argv[0], argc, argv, long_options, 0);

     while((opt = poptGetNextOpt(pc)) != -1) {

         switch(opt) {

diff --git a/src/responder/common/responder.h b/src/responder/common/responder.h

index cd2b3232c53e919c7d47170ccd1016a8604c9742..e3c0f226775d279ea8c0f300cc2de54d2f7f9b72 100644

--- a/src/responder/common/responder.h

+++ b/src/responder/common/responder.h

@@ -38,6 +38,10 @@

 extern hash_table_t *dp_requests;

+/* we want default permissions on created files to be very strict,

+ * so set our umask to 0177 */

+#define DFL_RSP_UMASK 0177

+

 /* if there is a provider other than the special local */

 #define NEED_CHECK_PROVIDER(provider) \

     (provider != NULL && strcmp(provider, "local") != 0)

diff --git a/src/responder/ifp/ifpsrv.c b/src/responder/ifp/ifpsrv.c

index eddeec9812bdd650bfbfb78ede91bf3704113504..367438c71b77576f1c7c3054061db684fd134c20 100644

--- a/src/responder/ifp/ifpsrv.c

+++ b/src/responder/ifp/ifpsrv.c

@@ -454,6 +454,8 @@ int main(int argc, const char *argv[])

     /* Set debug level to invalid value so we can deside if -d 0 was used. */

     debug_level = SSSDBG_INVALID;

+    umask(DFL_RSP_UMASK);

+

     pc = poptGetContext(argv[0], argc, argv, long_options, 0);

     while((opt = poptGetNextOpt(pc)) != -1) {

         switch(opt) {

diff --git a/src/responder/nss/nsssrv.c b/src/responder/nss/nsssrv.c

index cfb146464d224cdb8b517d23a86421da7eaccd1f..1bbeaa1534ee3e0db72dda13ff9d01ef7fba6adf 100644

--- a/src/responder/nss/nsssrv.c

+++ b/src/responder/nss/nsssrv.c

@@ -550,6 +550,8 @@ int main(int argc, const char *argv[])

     /* Set debug level to invalid value so we can deside if -d 0 was used. */

     debug_level = SSSDBG_INVALID;

+    umask(DFL_RSP_UMASK);

+

     pc = poptGetContext(argv[0], argc, argv, long_options, 0);

     while((opt = poptGetNextOpt(pc)) != -1) {

         switch(opt) {

diff --git a/src/responder/pac/pacsrv.c b/src/responder/pac/pacsrv.c

index 3eb21c8fff85343249494bcc06d97cda4b738034..859ae86a54daf268c73ab97b0a1f67967d7e714f 100644

--- a/src/responder/pac/pacsrv.c

+++ b/src/responder/pac/pacsrv.c

@@ -229,6 +229,8 @@ int main(int argc, const char *argv[])

     /* Set debug level to invalid value so we can decide if -d 0 was used. */

     debug_level = SSSDBG_INVALID;

+    umask(DFL_RSP_UMASK);

+

     pc = poptGetContext(argv[0], argc, argv, long_options, 0);

     while((opt = poptGetNextOpt(pc)) != -1) {

         switch(opt) {

diff --git a/src/responder/pam/pamsrv.c b/src/responder/pam/pamsrv.c

index c7e3c20b2731efb9393bc820ab09486c48e0a9ea..886136b420b6184a86ce6e0d9ac84dd3dea9a94b 100644

--- a/src/responder/pam/pamsrv.c

+++ b/src/responder/pam/pamsrv.c

@@ -332,6 +332,8 @@ int main(int argc, const char *argv[])

     /* Set debug level to invalid value so we can deside if -d 0 was used. */

     debug_level = SSSDBG_INVALID;

+    umask(DFL_RSP_UMASK);

+

     pc = poptGetContext(argv[0], argc, argv, long_options, 0);

     while((opt = poptGetNextOpt(pc)) != -1) {

         switch(opt) {

diff --git a/src/responder/ssh/sshsrv.c b/src/responder/ssh/sshsrv.c

index b1969b49de8579f0136c3afa78eb16d68c81ee4e..1bcf4e21a89e4e7b7697e9d90ab239cbf9d231e9 100644

--- a/src/responder/ssh/sshsrv.c

+++ b/src/responder/ssh/sshsrv.c

@@ -197,6 +197,8 @@ int main(int argc, const char *argv[])

     /* Set debug level to invalid value so we can deside if -d 0 was used. */

     debug_level = SSSDBG_INVALID;

+    umask(DFL_RSP_UMASK);

+

     pc = poptGetContext(argv[0], argc, argv, long_options, 0);

     while((opt = poptGetNextOpt(pc)) != -1) {

         switch(opt) {

diff --git a/src/responder/sudo/sudosrv.c b/src/responder/sudo/sudosrv.c

index a25f98ecabaa952a7cd87c54cd302903cb563faf..e480c7a43d453cffcd6ca07e41402c1cf6eef91c 100644

--- a/src/responder/sudo/sudosrv.c

+++ b/src/responder/sudo/sudosrv.c

@@ -177,6 +177,8 @@ int main(int argc, const char *argv[])

     /* Set debug level to invalid value so we can deside if -d 0 was used. */

     debug_level = SSSDBG_INVALID;

+    umask(DFL_RSP_UMASK);

+

     pc = poptGetContext(argv[0], argc, argv, long_options, 0);

     while((opt = poptGetNextOpt(pc)) != -1) {

         switch(opt) {

-- 

1.9.3