Re: [SSSD] [PATCH] IPA: Securely set umask for mkstemp in subdomain provider

2012-08-06 Thread Jakub Hrozek
On Mon, Aug 06, 2012 at 06:15:25PM +0200, Jakub Hrozek wrote: > On Mon, Aug 06, 2012 at 09:59:44AM -0400, Stephen Gallagher wrote: > > On Mon, 2012-08-06 at 09:56 -0400, Simo Sorce wrote: > > > On Mon, 2012-08-06 at 09:47 -0400, Stephen Gallagher wrote: > > > > Fixes https://fedorahosted.org/sssd/t

Re: [SSSD] [PATCH] IPA: Securely set umask for mkstemp in subdomain provider

2012-08-06 Thread Jakub Hrozek
On Mon, Aug 06, 2012 at 09:59:44AM -0400, Stephen Gallagher wrote: > On Mon, 2012-08-06 at 09:56 -0400, Simo Sorce wrote: > > On Mon, 2012-08-06 at 09:47 -0400, Stephen Gallagher wrote: > > > Fixes https://fedorahosted.org/sssd/ticket/1457 > > > > > > The permissions are later set with chmod() to

Re: [SSSD] [PATCH] IPA: Securely set umask for mkstemp in subdomain provider

2012-08-06 Thread Stephen Gallagher
On Mon, 2012-08-06 at 09:56 -0400, Simo Sorce wrote: > On Mon, 2012-08-06 at 09:47 -0400, Stephen Gallagher wrote: > > Fixes https://fedorahosted.org/sssd/ticket/1457 > > > > The permissions are later set with chmod() to the final values after > > it's moved to the real filename, so this is safe.

Re: [SSSD] [PATCH] IPA: Securely set umask for mkstemp in subdomain provider

2012-08-06 Thread Simo Sorce
On Mon, 2012-08-06 at 09:47 -0400, Stephen Gallagher wrote: > Fixes https://fedorahosted.org/sssd/ticket/1457 > > The permissions are later set with chmod() to the final values after > it's moved to the real filename, so this is safe. What't the point ? The default umask is already ok (strict),

[SSSD] [PATCH] IPA: Securely set umask for mkstemp in subdomain provider

2012-08-06 Thread Stephen Gallagher
Fixes https://fedorahosted.org/sssd/ticket/1457 The permissions are later set with chmod() to the final values after it's moved to the real filename, so this is safe. From 8e0a9d319ffc35e724c45789facde2852fa564d6 Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Mon, 6 Aug 2012 09:43:05 -040