mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-09-05 10:39:19 +02:00
Restrict file mode creation mask during tmpfile().
Per Coverity. Back-patch to 9.0 (all supported versions). Michael Paquier, reviewed (in earlier versions) by Heikki Linnakangas.
This commit is contained in:
parent
3d3bc2905f
commit
1be9d65e17
@ -379,8 +379,18 @@ tarOpen(ArchiveHandle *AH, const char *filename, char mode)
|
||||
}
|
||||
else
|
||||
{
|
||||
int old_umask;
|
||||
|
||||
tm = pg_malloc0(sizeof(TAR_MEMBER));
|
||||
|
||||
/*
|
||||
* POSIX does not require, but permits, tmpfile() to restrict file
|
||||
* permissions. Given an OS crash after we write data, the filesystem
|
||||
* might retain the data but forget tmpfile()'s unlink(). If so, the
|
||||
* file mode protects confidentiality of the data written.
|
||||
*/
|
||||
old_umask = umask(S_IRWXG | S_IRWXO);
|
||||
|
||||
#ifndef WIN32
|
||||
tm->tmpFH = tmpfile();
|
||||
#else
|
||||
@ -415,6 +425,8 @@ tarOpen(ArchiveHandle *AH, const char *filename, char mode)
|
||||
if (tm->tmpFH == NULL)
|
||||
exit_horribly(modulename, "could not generate temporary file name: %s\n", strerror(errno));
|
||||
|
||||
umask(old_umask);
|
||||
|
||||
#ifdef HAVE_LIBZ
|
||||
|
||||
if (AH->compression != 0)
|
||||
|
Loading…
Reference in New Issue
Block a user