Date: Fri, 23 Jul 1999 04:02:32 -0400 (EDT) From: Will Andrews <andrews@technologist.com> To: FreeBSD-gnats-submit@freebsd.org Subject: ports/12827: fix port: editors/joe Message-ID: <199907230802.EAA60812@shadow.blackdawn.com>
next in thread | raw e-mail | index | archive | help
>Number: 12827
>Category: ports
>Synopsis: fix port editors/joe
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-ports
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Mon Jul 26 18:00:01 PDT 1999
>Closed-Date:
>Last-Modified:
>Originator: Will Andrews
>Release: FreeBSD 3.2-STABLE i386
>Organization:
none
>Environment:
FreeBSD shadow.blackdawn.com 3.2-STABLE FreeBSD 3.2-STABLE #0: Wed Jun 23 12:45:46 EDT 1999 root@shadow.blackdawn.com:/usr/src/sys/compile/SHADOW i386
>Description:
This report was sent in by Trevor Johnson <trevor@jpj.net>, along with a
nice fix which I have tested on FreeBSD to make sure it works.
When joe is abnormally aborted, its DEADJOE file is world readable. This
can be a substantial security problem for editing files that are usually
only supposed to be readable by root - such as /etc/master.passwd.
>How-To-Repeat:
Start up joe like usual. Then kill -HUP it. It will create a DEADJOE file
that is world readable.. regardless of umask settings.
>Fix:
diff -urN joe/patches/patch-ad joe.new/patches/patch-ad
--- joe/patches/patch-ad Wed Dec 31 19:00:00 1969
+++ joe.new/patches/patch-ad Fri Jul 23 03:53:40 1999
@@ -0,0 +1,18 @@
+--- b.c Fri Jan 20 03:38:25 1995
++++ b.c.new Fri Jul 23 03:36:10 1999
+@@ -21,6 +21,7 @@
+ #include <pwd.h>
+ #endif
+ #include <errno.h>
++#include <sys/types.h>
+
+ #include "config.h"
+ #include "blocks.h"
+@@ -1990,6 +1991,7 @@
+ {
+ long tim=time(0);
+ B *b;
++ mode_t mask=umask(077); /* no access to DEADJOE for others */
+ FILE *f=fopen("DEADJOE","a");
+ fprintf(f,"\n*** Modified files in JOE when it aborted on %s",ctime(&tim));
+ if(sig) fprintf(f,"*** JOE was aborted by signal %d\n",sig);
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ports" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199907230802.EAA60812>