r13239@catbus: nickm | 2007-06-04 11:30:37 -0400

 Fix the fix for bug 445: set umask properly.  Also use open+fdopen rather than just umask+fopen, and create authority identity key with mode 400.


svn:r10485

4 files changed, 28 insertions, 8 deletions

diff --git a/ChangeLog b/ChangeLog
index 5f01af2ab9..e774c64144 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,7 +3,8 @@ Changes in version 0.2.0.3-alpha - 2007-??-??
     - Create listener connections before we setuid to the configured User and
       Group.  This way, you can choose port values under 1024, start Tor as
       root, and have Tor bind those ports before it changes to another UID.
-    - tor-gencert creates all files visible to the file creator only.
+    - tor-gencert creates all files as readable to the file creator only, and
+      write-protects the authority identity key.
 
   o Minor bugfixes (dns):
     - Fix a crash when DNSPort is set more than once. (Patch from Robert
diff --git a/src/common/crypto.c b/src/common/crypto.c
index d4059e0d75..bcb8a375a8 100644
--- a/src/common/crypto.c
+++ b/src/common/crypto.c
@@ -566,7 +566,6 @@ crypto_pk_write_private_key_to_filename(crypto_pk_env_t *env,
   s = tor_malloc(len+1);
   memcpy(s, cp, len);
   s[len]='\0';
-  /* XXXX020 make this file get created with mode 600. */
   r = write_str_to_file(fname, s, 0);
   BIO_free(bio);
   tor_free(s);
diff --git a/src/common/util.c b/src/common/util.c
index 74279cee7a..4c9370945d 100644
--- a/src/common/util.c
+++ b/src/common/util.c
@@ -1371,7 +1371,9 @@ check_private_dir(const char *dirname, cpd_check_t check)
 /** Create a file named <b>fname</b> with the contents <b>str</b>.  Overwrite
  * the previous <b>fname</b> if possible.  Return 0 on success, -1 on failure.
  *
- * This function replaces the old file atomically, if possible.
+ * This function replaces the old file atomically, if possible.  This
+ * function, and all other functions in util.c that create files, create them
+ * with mode 0600.
  */
 int
 write_str_to_file(const char *fname, const char *str, int bin)
diff --git a/src/tools/tor-gencert.c b/src/tools/tor-gencert.c
index e4bc01df73..c879c9760c 100644
--- a/src/tools/tor-gencert.c
+++ b/src/tools/tor-gencert.c
@@ -9,6 +9,8 @@
 
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
 
 #include <openssl/evp.h>
 #include <openssl/pem.h>
@@ -149,6 +151,7 @@ load_identity_key(void)
   FILE *f;
 
   if (make_new_id) {
+    int fd;
     RSA *key;
     if (status != FN_NOENT) {
       log_err(LD_GENERAL, "--create-identity-key was specified, but %s "
@@ -168,8 +171,15 @@ load_identity_key(void)
       return 1;
     }
 
-    if (!(f = fopen(identity_key_file, "w"))) {
-      log_err(LD_GENERAL, "Couldn't open %s for writing: %s",
+    if ((fd = open(identity_key_file, O_CREAT|O_EXCL|O_WRONLY, 0400))<0) {
+      log_err(LD_GENERAL, "Couldn't fdopen %s for writing: %s",
+              identity_key_file, strerror(errno));
+      return 1;
+    }
+
+    if (!(f = fdopen(fd, "w"))) {
+      close(fd);
+      log_err(LD_GENERAL, "Couldn't fdopen %s for writing: %s",
               identity_key_file, strerror(errno));
       return 1;
     }
@@ -214,6 +224,7 @@ load_identity_key(void)
 static int
 generate_signing_key(void)
 {
+  int fd;
   FILE *f;
   RSA *key;
   log_notice(LD_GENERAL, "Generating %d-bit RSA signing key.",
@@ -229,8 +240,15 @@ generate_signing_key(void)
     return 1;
   }
 
-  if (!(f = fopen(signing_key_file, "w"))) {
-    log_err(LD_GENERAL, "Couldn't open %s for reading: %s",
+  if ((fd = open(signing_key_file, O_CREAT|O_EXCL|O_WRONLY, 0600))<0) {
+    log_err(LD_GENERAL, "Couldn't open %s for writing: %s",
+            signing_key_file, strerror(errno));
+    return 1;
+  }
+
+  if (!(f = fdopen(fd, "w"))) {
+    close(fd);
+    log_err(LD_GENERAL, "Couldn't open %s for writing: %s",
             signing_key_file, strerror(errno));
     return 1;
   }
@@ -358,7 +376,7 @@ main(int argc, char **argv)
     goto done;
   }
   /* Make sure that files are made private. */
-  umask(0700);
+  umask(0077);
 
   if (parse_commandline(argc, argv))
     goto done;