diff options
author | joerg <joerg@FreeBSD.org> | 1996-04-26 21:33:18 +0000 |
---|---|---|
committer | joerg <joerg@FreeBSD.org> | 1996-04-26 21:33:18 +0000 |
commit | 2d430f5746ff743957a88b3d67c2cb037327ad56 (patch) | |
tree | 7e6e5bd70e59bafc8d15db198b5eecdbf08cd9d9 /lib | |
parent | 6f11b21010882d6fedd9099d8da85e401bb0d642 (diff) | |
download | FreeBSD-src-2d430f5746ff743957a88b3d67c2cb037327ad56.zip FreeBSD-src-2d430f5746ff743957a88b3d67c2cb037327ad56.tar.gz |
/etc/skeykeys was basically suffering from the same vulnerability
as any non-shadowed /etc/passwd. Ironically, all programs using S/Key
have already been setuid root except keyinfo(1).
This modification creates /etc/skeykeys with mode 0600 to prevent it
from being examined by ordinary users.
Diffstat (limited to 'lib')
-rw-r--r-- | lib/libskey/skeylogin.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/libskey/skeylogin.c b/lib/libskey/skeylogin.c index 229fc61..ee9c277 100644 --- a/lib/libskey/skeylogin.c +++ b/lib/libskey/skeylogin.c @@ -103,11 +103,13 @@ char *name; long recstart; char *cp, *p; struct stat statbuf; + mode_t oldmask; /* See if the _PATH_SKEYFILE exists, and create it if not */ if(stat(_PATH_SKEYFILE,&statbuf) == -1 && errno == ENOENT){ + oldmask = umask(S_IRWXG|S_IRWXO); mp->keyfile = fopen(_PATH_SKEYFILE,"w+"); - (void) chmod(_PATH_SKEYFILE, 0644); + (void)umask(oldmask); } else { /* Otherwise open normally for update */ mp->keyfile = fopen(_PATH_SKEYFILE,"r+"); |