ldap/servers/slapd/daemon.c | 10 ++++++---- ldap/servers/slapd/main.c | 10 ++++++---- ldap/servers/slapd/protect_db.c | 6 +++--- 3 files changed, 15 insertions(+), 11 deletions(-)

New commits: commit 81fe698ca04d1dccc23e8099003521471120bacf Author: Noriko Hosoi nhosoi@redhat.com Date: Fri Oct 29 09:43:52 2010 -0700

Bug 638773 - permissions too loose on pid and lock files

https://bugzilla.redhat.com/show_bug.cgi?id=638773

Description: This patch changes the permissions of the pid and lock files to be writable only by the owner (0644). They should remain readable by all since they may serve in an advisory role to other processes that need to determine if it's running.

Checking in this patch on behalf of Ulf Weltman (ulf.weltman@hp.com).

diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c index 2862016..705db50 100644 --- a/ldap/servers/slapd/daemon.c +++ b/ldap/servers/slapd/daemon.c @@ -2432,11 +2432,13 @@ write_pid_file() if ( (fp = fopen( get_pid_file(), "w" )) != NULL ) { fprintf( fp, "%d\n", getpid() ); fclose( fp ); - return 0; - } else - { - return -1; + if ( chmod(get_pid_file(), S_IWUSR|S_IRUSR|S_IRGRP|S_IROTH) != 0 ) { + unlink(get_pid_file()); + } else { + return 0; + } } + return -1; } #endif /* WIN32 */

diff --git a/ldap/servers/slapd/main.c b/ldap/servers/slapd/main.c index 2ad53b7..5609a21 100644 --- a/ldap/servers/slapd/main.c +++ b/ldap/servers/slapd/main.c @@ -627,11 +627,13 @@ write_start_pid_file() if ( (fp = fopen( start_pid_file, "w" )) != NULL ) { fprintf( fp, "%d\n", getpid() ); fclose( fp ); - return 0; - } else - { - return -1; + if ( chmod(start_pid_file, S_IWUSR|S_IRUSR|S_IRGRP|S_IROTH) != 0 ) { + unlink(start_pid_file); + } else { + return 0; + } } + return -1; } #endif /* WIN32 */

diff --git a/ldap/servers/slapd/protect_db.c b/ldap/servers/slapd/protect_db.c index ce11394..6f8b8fe 100644 --- a/ldap/servers/slapd/protect_db.c +++ b/ldap/servers/slapd/protect_db.c @@ -97,7 +97,7 @@ grab_lockfile() pid = getpid();

/* Try to grab it */ - if ((fd = open(lockfile, O_RDWR | O_CREAT | O_EXCL, 0664)) != -1) { + if ((fd = open(lockfile, O_RDWR | O_CREAT | O_EXCL, 0644)) != -1) { /* We got the lock, write our pid to the file */ write(fd, (void *) &pid, sizeof(pid_t)); close(fd); @@ -116,7 +116,7 @@ grab_lockfile() t.tv_sec = 0; t.tv_usec = WAIT_TIME * 1000; for(x = 0; x < NUM_TRIES; x++) { - if ((fd = open(lockfile, O_RDWR | O_CREAT | O_EXCL, 0664)) != -1) { + if ((fd = open(lockfile, O_RDWR | O_CREAT | O_EXCL, 0644)) != -1) { /* Got the lock */ write(fd, (void *) &pid, sizeof(pid_t)); close(fd); @@ -233,7 +233,7 @@ add_this_process_to(char *dir_name) snprintf(file_name, sizeof(file_name), "%s/%d", dir_name, getpid()); file_name[sizeof(file_name)-1] = (char)0;

- if ((prfd = PR_Open(file_name, PR_RDWR | PR_CREATE_FILE, 0666)) == NULL) { + if ((prfd = PR_Open(file_name, PR_RDWR | PR_CREATE_FILE, 0644)) == NULL) { LDAPDebug(LDAP_DEBUG_ANY, FILE_CREATE_WARNING, file_name, 0, 0); return; }