umask: set umask of a number of sockets by default, even though we check creds on connections
This commit is contained in:
parent
260d370833
commit
1d6702e8d3
3
TODO
3
TODO
|
@ -19,6 +19,9 @@ Bugfixes:
|
||||||
|
|
||||||
Features:
|
Features:
|
||||||
|
|
||||||
|
* allow Type=simple with PIDFile=
|
||||||
|
https://bugzilla.redhat.com/show_bug.cgi?id=723942
|
||||||
|
|
||||||
* generator dir is 666?
|
* generator dir is 666?
|
||||||
|
|
||||||
* set access mode of /run/systemd/{private,notify} to 666, not 777
|
* set access mode of /run/systemd/{private,notify} to 666, not 777
|
||||||
|
|
|
@ -250,6 +250,7 @@ static int create_socket(char **name) {
|
||||||
} sa;
|
} sa;
|
||||||
int one = 1, r;
|
int one = 1, r;
|
||||||
char *c;
|
char *c;
|
||||||
|
mode_t u;
|
||||||
|
|
||||||
assert(name);
|
assert(name);
|
||||||
|
|
||||||
|
@ -262,7 +263,11 @@ static int create_socket(char **name) {
|
||||||
sa.un.sun_family = AF_UNIX;
|
sa.un.sun_family = AF_UNIX;
|
||||||
snprintf(sa.un.sun_path, sizeof(sa.un.sun_path)-1, "/run/systemd/ask-password/sck.%llu", random_ull());
|
snprintf(sa.un.sun_path, sizeof(sa.un.sun_path)-1, "/run/systemd/ask-password/sck.%llu", random_ull());
|
||||||
|
|
||||||
if (bind(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path)) < 0) {
|
u = umask(0177);
|
||||||
|
r = bind(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
|
||||||
|
umask(u);
|
||||||
|
|
||||||
|
if (r < 0) {
|
||||||
r = -errno;
|
r = -errno;
|
||||||
log_error("bind() failed: %m");
|
log_error("bind() failed: %m");
|
||||||
goto fail;
|
goto fail;
|
||||||
|
@ -310,6 +315,7 @@ int ask_password_agent(
|
||||||
int socket_fd = -1, signal_fd = -1;
|
int socket_fd = -1, signal_fd = -1;
|
||||||
sigset_t mask, oldmask;
|
sigset_t mask, oldmask;
|
||||||
struct pollfd pollfd[_FD_MAX];
|
struct pollfd pollfd[_FD_MAX];
|
||||||
|
mode_t u;
|
||||||
|
|
||||||
assert(_passphrases);
|
assert(_passphrases);
|
||||||
|
|
||||||
|
@ -319,7 +325,11 @@ int ask_password_agent(
|
||||||
|
|
||||||
mkdir_p("/run/systemd/ask-password", 0755);
|
mkdir_p("/run/systemd/ask-password", 0755);
|
||||||
|
|
||||||
if ((fd = mkostemp(temp, O_CLOEXEC|O_CREAT|O_WRONLY)) < 0) {
|
u = umask(0022);
|
||||||
|
fd = mkostemp(temp, O_CLOEXEC|O_CREAT|O_WRONLY);
|
||||||
|
umask(u);
|
||||||
|
|
||||||
|
if (fd < 0) {
|
||||||
log_error("Failed to create password file: %m");
|
log_error("Failed to create password file: %m");
|
||||||
r = -errno;
|
r = -errno;
|
||||||
goto finish;
|
goto finish;
|
||||||
|
|
|
@ -76,7 +76,8 @@ static int manager_setup_notify(Manager *m) {
|
||||||
struct sockaddr_un un;
|
struct sockaddr_un un;
|
||||||
} sa;
|
} sa;
|
||||||
struct epoll_event ev;
|
struct epoll_event ev;
|
||||||
int one = 1;
|
int one = 1, r;
|
||||||
|
mode_t u;
|
||||||
|
|
||||||
assert(m);
|
assert(m);
|
||||||
|
|
||||||
|
@ -99,7 +100,11 @@ static int manager_setup_notify(Manager *m) {
|
||||||
if (sa.un.sun_path[0] == '@')
|
if (sa.un.sun_path[0] == '@')
|
||||||
sa.un.sun_path[0] = 0;
|
sa.un.sun_path[0] = 0;
|
||||||
|
|
||||||
if (bind(m->notify_watch.fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + 1 + strlen(sa.un.sun_path+1)) < 0) {
|
u = umask(0111);
|
||||||
|
r = bind(m->notify_watch.fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + 1 + strlen(sa.un.sun_path+1));
|
||||||
|
umask(u);
|
||||||
|
|
||||||
|
if (r < 0) {
|
||||||
log_error("bind() failed: %m");
|
log_error("bind() failed: %m");
|
||||||
return -errno;
|
return -errno;
|
||||||
}
|
}
|
||||||
|
|
|
@ -14,3 +14,4 @@ Before=sockets.target
|
||||||
|
|
||||||
[Socket]
|
[Socket]
|
||||||
ListenDatagram=/run/systemd/shutdownd
|
ListenDatagram=/run/systemd/shutdownd
|
||||||
|
SocketMode=0600
|
||||||
|
|
Loading…
Reference in New Issue