From ec4ef68271ab65b4ec643088153211e861cdc7b3 Mon Sep 17 00:00:00 2001
From: Jamie Nguyen <j@jamielinux.com>
Date: Fri, 13 Nov 2015 14:18:26 +0000
Subject: Introduce DataDirectoryGroupReadable boolean

---
 src/or/config.c | 17 ++++++++++++++++-
 src/or/or.h     |  1 +
 2 files changed, 17 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/or/config.c b/src/or/config.c
index 8d8c186d9c..d9ba774e7e 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -212,6 +212,7 @@ static config_var_t option_vars_[] = {
   V(CookieAuthFile,              STRING,   NULL),
   V(CountPrivateBandwidth,       BOOL,     "0"),
   V(DataDirectory,               FILENAME, NULL),
+  V(DataDirectoryGroupReadable,  BOOL,     "0"),
   V(DisableNetwork,              BOOL,     "0"),
   V(DirAllowPrivateAddresses,    BOOL,     "0"),
   V(TestingAuthDirTimeToLearnReachability, INTERVAL, "30 minutes"),
@@ -1186,16 +1187,30 @@ options_act_reversible(const or_options_t *old_options, char **msg)
   }
 
   /* Ensure data directory is private; create if possible. */
+  cpd_check_t cpd_group_opts = CPD_NONE;
+  if (options->DataDirectoryGroupReadable)
+      cpd_group_opts = CPD_GROUP_READ;
   if (check_private_dir(options->DataDirectory,
-                        running_tor ? CPD_CREATE : CPD_CHECK,
+                        running_tor ?
+                        CPD_CREATE|cpd_group_opts : CPD_CHECK|cpd_group_opts,
                         options->User)<0) {
     tor_asprintf(msg,
               "Couldn't access/create private data directory \"%s\"",
               options->DataDirectory);
+
     goto done;
     /* No need to roll back, since you can't change the value. */
   }
 
+#ifndef _WIN32
+  if (options->DataDirectoryGroupReadable) {
+    /* Only new dirs created get new opts, also enforce group read. */
+    if (chmod(options->DataDirectory, 0750)) {
+      log_warn(LD_FS,"Unable to make %s group-readable.", options->DataDirectory);
+    }
+  }
+#endif
+
   /* Bail out at this point if we're not going to be a client or server:
    * we don't run Tor itself. */
   if (!running_tor)
diff --git a/src/or/or.h b/src/or/or.h
index 5d02ed7037..945934e271 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -3436,6 +3436,7 @@ typedef struct {
 
   char *DebugLogFile; /**< Where to send verbose log messages. */
   char *DataDirectory; /**< OR only: where to store long-term data. */
+  int DataDirectoryGroupReadable; /**< Boolean: Is the DataDirectory g+r? */
   char *Nickname; /**< OR only: nickname of this onion router. */
   char *Address; /**< OR only: configured address for this onion router. */
   char *PidFile; /**< Where to store PID of Tor process. */
-- 
cgit v1.2.3-54-g00ecf