xsane overwrites user's umask

[Adrien Thebo]

Binary package hint: xsane

xsane overwrites the user's umask to 0007, and creates ~/.sane and other files with the according 770 permissions on directories and 660 on files containing the printer description. This is dangerous in a multiuser environment.

The umask is set on line in xsane.h
 107 #define XSANE_DEFAULT_UMASK 0007

This is used throughout the codebase.
> grep XSANE_DEFAULT_UMASK *
xsane.c: umask(XSANE_DEFAULT_UMASK); /* define new file permissions */
xsane.c: umask(XSANE_DEFAULT_UMASK); /* define new file permissions */
xsane.c: umask(XSANE_DEFAULT_UMASK); /* define permissions of new files */
xsane-device-preferences.c: umask(XSANE_DEFAULT_UMASK); /* define new file permissions */
xsane-email-project.c: umask(XSANE_DEFAULT_UMASK); /* define new file permissions */
xsane-fax-project.c: umask(XSANE_DEFAULT_UMASK); /* define new file permissions */
xsane-fax-project.c: umask(XSANE_DEFAULT_UMASK); /* define new file permissions */
xsane-fax-project.c: umask(XSANE_DEFAULT_UMASK); /* define new file permissions */
xsane-front-gtk.c: umask(XSANE_DEFAULT_UMASK); /* define new file permissions */
xsane.h:#define XSANE_DEFAULT_UMASK 0007
xsane-multipage-project.c: umask(XSANE_DEFAULT_UMASK); /* define new file permissions */
xsane-save.c: umask(XSANE_DEFAULT_UMASK); /* define new file permissions */
xsane-viewer.c: umask(XSANE_DEFAULT_UMASK); /* define new file permissions */
xsane-viewer.c: umask(XSANE_DEFAULT_UMASK); /* define new file permissions */

Steps to reproduce:
1. rm -r ~/.sane
2. xsane

[Adrien Thebo (adrien-thebo)]

Patch that should set the default umask to something more secure.

[Launchpad Janitor (janitor)]

This bug was fixed in the package xsane - 0.997-2ubuntu3

---------------
xsane (0.997-2ubuntu3) maverick; urgency=low

  [Adrien Thebo]
  * Fix umask permitions (LP: #611950)
    - debian/patches/fix_umask_permitions.patch
 -- chilicuil <[e-mail]> Sat, 14 Aug 2010 02:38:18 -0500