Fix bug #67060: use default mode of 660

diff --git a/NEWS b/NEWS
index 72c093992561048604f0d526a6e7655e3252bc8c..264b438b595b1f51d5e8970832ce6e5f17ce8244 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,10 @@ PHP                                                                        NEWS
   . Fixed memory corruption in openssl_x509_parse() (CVE-2013-6420).
     (Stefan Esser).
 
+- FPM:
+  . Fixed bug #67060 (sapi/fpm: possible privilege escalation due to insecure
+    default configuration) (CVE-2014-0185). (Stas)
+
 11 Jul 2013, PHP 5.3.27
 
 - Core:

diff --git a/sapi/fpm/fpm/fpm_unix.c b/sapi/fpm/fpm/fpm_unix.c
index 48249e8a49488bf3cab77245636dd2bd872870b3..ea0e67369cd534448894db87c1ab31a8b7ecad96 100644 (file)
--- a/sapi/fpm/fpm/fpm_unix.c
+++ b/sapi/fpm/fpm/fpm_unix.c
@@ -35,7 +35,7 @@ int fpm_unix_resolve_socket_premissions(struct fpm_worker_pool_s *wp) /* {{{ */
        /* uninitialized */
        wp->socket_uid = -1;
        wp->socket_gid = -1;
-       wp->socket_mode = 0666;
+       wp->socket_mode = 0660;
 
        if (!c) {
                return 0;

diff --git a/sapi/fpm/php-fpm.conf.in b/sapi/fpm/php-fpm.conf.in
index 44e4dbac080c975556e6dd49e68b2ca9e1a25d86..e8efc7020a683f150c4f6925921e2092c4833780 100644 (file)
--- a/sapi/fpm/php-fpm.conf.in
+++ b/sapi/fpm/php-fpm.conf.in
@@ -158,10 +158,10 @@ listen = 127.0.0.1:9000
 ; permissions must be set in order to allow connections from a web server. Many
 ; BSD-derived systems allow connections regardless of permissions. 
 ; Default Values: user and group are set as the running user
-;                 mode is set to 0666
+;                 mode is set to 0660
 ;listen.owner = @php_fpm_user@
 ;listen.group = @php_fpm_group@
-;listen.mode = 0666
+;listen.mode = 0660
  
 ; List of ipv4 addresses of FastCGI clients which are allowed to connect.
 ; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original