From: Guus Sliepen Date: Mon, 22 Jul 2013 20:58:13 +0000 (+0200) Subject: Honour umask, let temporary key files inherit original's permissions. X-Git-Tag: release-1.1pre8~19 X-Git-Url: https://git.tinc-vpn.org/git/browse?a=commitdiff_plain;h=5fca595b80f5d2a6629d74e89ca2ef46ba9ae292;p=tinc Honour umask, let temporary key files inherit original's permissions. During the init command, tinc changed the umask to 077 when writing the public and private key files, to prevent the temporary copies from being world readable. However, subsequently created files would therefore also be unreadable for others. Now we don't change the umask anymore, therefore allowing the user to choose whether the files are world readable or not by setting the umask as desired. The private key files are still made unreadable for others of course. Temporary files now inherit the permissions of the original, and the tinc-up script's permissions now also honour the umask. --- diff --git a/src/tincctl.c b/src/tincctl.c index 4c5102b2..f6e60fe6 100644 --- a/src/tincctl.c +++ b/src/tincctl.c @@ -227,6 +227,16 @@ static void disable_old_keys(const char *filename, const char *what) { w = fopen(tmpfile, "w"); +#ifdef HAVE_FCHMOD + /* Let the temporary file have the same permissions as the original. */ + + if(w) { + struct stat st = {.st_mode = 0600}; + fstat(fileno(r), &st); + fchmod(fileno(w), st.st_mode); + } +#endif + while(fgets(buf, sizeof buf, r)) { if(!block && !strncmp(buf, "-----BEGIN ", 11)) { if((strstr(buf, " EC ") && strstr(what, "ECDSA")) || (strstr(buf, " RSA ") && strstr(what, "RSA"))) { @@ -324,8 +334,6 @@ static FILE *ask_and_open(const char *filename, const char *what, const char *mo filename = buf2; } - umask(0077); /* Disallow everything for group and other */ - disable_old_keys(filename, what); /* Open it first to keep the inode busy */ @@ -1702,7 +1710,9 @@ static int cmd_init(int argc, char *argv[]) { fprintf(stderr, "Could not create file %s: %s\n", filename, strerror(errno)); return 1; } - fchmod(fileno(f), 0755); + mode_t mask = umask(0); + umask(mask); + fchmod(fileno(f), 0755 & ~mask); fprintf(f, "#!/bin/sh\n\necho 'Unconfigured tinc-up script, please edit!'\n\n#ifconfig $INTERFACE netmask \n"); fclose(f); }