From 5dc49efe9012793110ef5dab9a9a1a7730a70e3f Mon Sep 17 00:00:00 2001 From: Noah Misch Date: Sun, 20 Sep 2015 20:42:27 -0400 Subject: [PATCH] Restrict file mode creation mask during tmpfile(). Per Coverity. Back-patch to 9.0 (all supported versions). Michael Paquier, reviewed (in earlier versions) by Heikki Linnakangas. --- src/bin/pg_dump/pg_backup_tar.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/bin/pg_dump/pg_backup_tar.c b/src/bin/pg_dump/pg_backup_tar.c index bd2ba7add9..7995f6e19f 100644 --- a/src/bin/pg_dump/pg_backup_tar.c +++ b/src/bin/pg_dump/pg_backup_tar.c @@ -372,8 +372,18 @@ tarOpen(ArchiveHandle *AH, const char *filename, char mode) } else { + int old_umask; + tm = calloc(1, sizeof(TAR_MEMBER)); + /* + * POSIX does not require, but permits, tmpfile() to restrict file + * permissions. Given an OS crash after we write data, the filesystem + * might retain the data but forget tmpfile()'s unlink(). If so, the + * file mode protects confidentiality of the data written. + */ + old_umask = umask(S_IRWXG | S_IRWXO); + #ifndef WIN32 tm->tmpFH = tmpfile(); #else @@ -408,6 +418,8 @@ tarOpen(ArchiveHandle *AH, const char *filename, char mode) if (tm->tmpFH == NULL) die_horribly(AH, modulename, "could not generate temporary file name: %s\n", strerror(errno)); + umask(old_umask); + #ifdef HAVE_LIBZ if (AH->compression != 0) -- 2.40.0