please reconsider umask(0)

Bug #1628738 reported by Seth Arnold
256
This bug affects 1 person
Affects Status Importance Assigned to Milestone
oslo.privsep
New
Undecided
Unassigned

Bug Description

Hello; I'm conducting a very quick review of oslo.privsep as part of the Ubuntu main inclusion process.

This isn't strictly a bug but I'd like to suggest that the 'umask(0)' call here be replaced with a safer umask, e.g. 0022 or 0077:

    def run(self):
        """Run request loop. Sets up environment, then calls loop()"""
        os.chdir("/")
        os.umask(0)
        self._drop_privs()
        self._close_stdio()

        self.loop()

I know W Richard Stevens put 'umask(0)' into his daemonize() routines but I think that was a mistake. The umask mode should be a fail-safe mode rather than a fail-open mode.

Thanks

information type: Private Security → Public Security
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.