Implement umask_override

diff --git a/def_data.c b/def_data.c
index 6a83be43ed7ea89e0830b86027fb0aaac5b9daea..8498464dbe1e32250589ead5ae1eb9bb973fe3c9 100644 (file)
--- a/def_data.c
+++ b/def_data.c
@@ -310,6 +310,10 @@ struct sudo_defs_types sudo_defs_table[] = {
        "fast_glob", T_FLAG,
        "Use faster globbing that is less accurate but does not access the filesystem",
        NULL,
+    }, {
+       "umask_override", T_FLAG,
+       "The umask specified in sudoers will override the user's, even if it is more permissive",
+       NULL,
     }, {
        NULL, 0, NULL
     }

diff --git a/def_data.h b/def_data.h
index 5f38375efa5fd1b1a2ae566950b93c6cee1b2018..bccfd160b8cebf6f6ee8a148ecfb1ecbee588431 100644 (file)
--- a/def_data.h
+++ b/def_data.h
@@ -142,6 +142,8 @@
 #define I_PWFEEDBACK            70
 #define def_fast_glob           (sudo_defs_table[71].sd_un.flag)
 #define I_FAST_GLOB             71
+#define def_umask_override      (sudo_defs_table[72].sd_un.flag)
+#define I_UMASK_OVERRIDE        72
 
 enum def_tupple {
        never,

diff --git a/def_data.in b/def_data.in
index 037019767eeaa88fc36c8877aa4db500f5efadcc..625c1409729d61ebcc34958626899bef7e23ccaf 100644 (file)
--- a/def_data.in
+++ b/def_data.in
@@ -229,3 +229,6 @@ pwfeedback
 fast_glob
        T_FLAG
        "Use faster globbing that is less accurate but does not access the filesystem"
+umask_override
+       T_FLAG
+       "The umask specified in sudoers will override the user's, even if it is more permissive"

diff --git a/sudo.c b/sudo.c
index 6ff8096b14a2377243c74ed6b0ab373a8bcb00a2..71186ef2cc3c8479cc5028b6b75242eb46148a98 100644 (file)
--- a/sudo.c
+++ b/sudo.c
@@ -453,14 +453,19 @@ main(argc, argv, envp)
            exit(rc);
 
        /*
-        * Override user's umask if configured to do so.
-        * If user's umask is more restrictive, OR in those bits too.
+        * Set umask based on sudoers.
+        * If user's umask is more restrictive, OR in those bits too
+        * unless umask_override is set.
         */
        if (def_umask != 0777) {
-           mode_t mask = umask(def_umask);
-           mask |= def_umask;
-           if (mask != def_umask)
-               umask(mask);
+           if (def_umask_override) {
+               umask(def_umask);
+           } else {
+               mode_t mask = umask(def_umask);
+               mask |= def_umask;
+               if (mask != def_umask)
+                   umask(mask);
+           }
        }
 
        /* Restore coredumpsize resource limit. */
@@ -537,7 +542,8 @@ main(argc, argv, envp)
            NewArgv[0] = "sh";
            NewArgv[1] = safe_cmnd;
            execv(_PATH_BSHELL, NewArgv);
-       } warning("unable to execute %s", safe_cmnd);
+       }
+       warning("unable to execute %s", safe_cmnd);
        exit(127);
     } else if (ISSET(validated, FLAG_NO_USER | FLAG_NO_HOST)) {
        audit_failure(NewArgv, "No user or host");

diff --git a/sudoers.pod b/sudoers.pod
index bca770f0987d7430e00d2e2911c3ff508a86867f..82db17e339d371bdc45fdc03662c48d2066ae9e3 100644 (file)
--- a/sudoers.pod
+++ b/sudoers.pod
@@ -781,6 +781,15 @@ the user running it.  With this flag enabled, B<sudo> will use a
 file named for the tty the user is logged in on in that directory.
 This flag is I<@tty_tickets@> by default.
 
+=item umask_override
+
+If set, B<sudo> will set the umask as specified by I<sudoers> without
+modification.  This makes it possible to specify a more permissive
+umask in I<sudoers> than the user's own umask and matches historical
+behavior.  If I<umask_override> is not set, B<sudo> will set the
+umask to be the union of the user's umask and what is specified in
+I<sudoers>.  This flag is I<off> by default.
+
 =item use_loginclass
 
 If set, B<sudo> will apply the defaults specified for the target user's