# HG changeset patch
# User Jeroen Demeyer <jdemeyer@cage.ugent.be>
# Date 1351545665 -3600
# Node ID ba32bad781d4168138021df319db41ab65d5f3c8
# Parent dd3260fd0af1959ea1266ee02c1d6f343d13ee3c
Trac #13631: Keep in mind umask when checking security of "python -c"
diff --git a/SPKG.txt b/SPKG.txt
a
|
b
|
|
63 | 63 | |
64 | 64 | == Changelog == |
65 | 65 | |
| 66 | === python-2.7.3.p2 (Jeroen Demeyer, 29 October 2012) === |
| 67 | * Trac #13631: Keep in mind umask when checking security of "python -c" |
| 68 | |
66 | 69 | === python-2.7.3.p1 (Jeroen Demeyer, 14 October 2012) === |
67 | 70 | * Trac #13579: add sys_path_security.patch. |
68 | 71 | |
diff --git a/patches/sys_path_security.patch b/patches/sys_path_security.patch
a
|
b
|
|
1 | 1 | diff -ru src/Python/sysmodule.c b/Python/sysmodule.c |
2 | 2 | --- src/Python/sysmodule.c 2012-04-10 01:07:35.000000000 +0200 |
3 | | +++ b/Python/sysmodule.c 2012-10-15 22:56:39.167513055 +0200 |
| 3 | +++ b/Python/sysmodule.c 2012-10-29 22:18:46.337514322 +0100 |
4 | 4 | @@ -46,6 +46,10 @@ |
5 | 5 | #include <langinfo.h> |
6 | 6 | #endif |
… |
… |
|
152 | 152 | #endif /* RISCOS */ |
153 | 153 | #if SEP == '/' /* Special case for Unix filename syntax */ |
154 | 154 | if (n > 1) |
155 | | @@ -1691,12 +1688,139 @@ |
| 155 | @@ -1691,12 +1688,146 @@ |
156 | 156 | #endif /* Unix */ |
157 | 157 | } |
158 | 158 | #endif /* All others */ |
… |
… |
|
202 | 202 | + arg_stat.st_mode |= parent_stat.st_mode; |
203 | 203 | + } else { |
204 | 204 | + /* given_arg was "" or stat() failed, manually set relevant |
205 | | + * stat members to safe values. */ |
206 | | + arg_stat.st_mode = 0644; |
| 205 | + * stat members to sensible values. Set the mode to whatever |
| 206 | + * it would be if we would create a new file, keeping in mind |
| 207 | + * the current umask. */ |
| 208 | + unsigned int mask = umask(0777); umask(mask); |
| 209 | + arg_stat.st_mode = 0666 & ~mask; |
207 | 210 | + arg_stat.st_uid = 0; |
| 211 | + /* Only keep group bit if the current group ID is the same as |
| 212 | + * the group of "parent" */ |
| 213 | + if (getgid() != parent_stat.st_gid) |
| 214 | + arg_stat.st_mode &= 0707; |
208 | 215 | + } |
209 | 216 | + |
210 | 217 | + if (stat(Py_GetProgramFullPath(), &program_stat) == 0) { |