save and restore umask before database creation

opendnssec · Jan 10, 2014 · dc2914a · dc2914a
1 parent f9d3499
commit dc2914a
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/src/lib/SoftDatabase.cpp b/src/lib/SoftDatabase.cpp
@@ -40,6 +40,9 @@
 #include <stdio.h>
 #include <string.h>
 #include <sched.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
 using std::string;
 
 // Rollback the object if it can't be saved
@@ -114,8 +117,12 @@ SoftDatabase::~SoftDatabase() {
 }
 
 CK_RV SoftDatabase::init(char *dbPath) {
+  // Circumvent the sqlite3 reliance on umask to enforce secure permissions
+  mode_t saved_umask = umask(S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH);
   // Open the database
   int result = sqlite3_open(dbPath, &db);
+  // Restore umask to avoid side effects
+  (void) umask(saved_umask);
   if(result) {
     char warnMsg[1024];
     snprintf(warnMsg, sizeof(warnMsg), "Could not open token database. Probably wrong privileges: %s", dbPath);

diff --git a/src/lib/tokenhandling.cpp b/src/lib/tokenhandling.cpp
@@ -40,6 +40,8 @@
 #include <stdlib.h>
 #include <stdio.h>
 #include <sqlite3.h>
+#include <sys/types.h>
+#include <sys/stat.h>
 
 #define EXEC_DB(db, sql) \
   if(sqlite3_exec(db, sql, NULL, NULL, NULL)) { \
@@ -99,9 +101,13 @@ CK_RV softInitToken(SoftSlot *currentSlot, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinL
     }
   }
 
+  // Circumvent the sqlite3 reliance on umask to enforce secure permissions
+  mode_t saved_umask = umask(S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH);
   // Open the database
   sqlite3 *db = NULL;
   int result = sqlite3_open(currentSlot->dbPath, &db);
+  // Restore umask to avoid side effects
+  (void) umask(saved_umask);
   if(result){
     if(db != NULL) {
       sqlite3_close(db);