GNU bug report logs - #10400
auto-save permissions race condition

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 10400 in the body.
You can then email your comments to 10400 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: bug-gnu-emacs <at> gnu.org
Subject: auto-save permissions race condition
Date: Thu, 29 Dec 2011 12:55:29 -0800

Tags: patch

This closes a minor security hole.

=== modified file 'src/ChangeLog'
--- src/ChangeLog	2011-12-28 07:55:49 +0000
+++ src/ChangeLog	2011-12-29 20:44:31 +0000
@@ -1,3 +1,15 @@
+2011-12-29  Paul Eggert  <eggert <at> cs.ucla.edu>
+
+	emacs: fix an auto-save permissions race condition
+	* fileio.c (auto_saving_dir_umask): New static var.
+	(Fmake_directory_internal): Use it.
+	(do_auto_save_make_dir): Set it, instead of invoking chmod after
+	creating the directory.  The old code temporarily assigns
+	too-generous permissions to the directory.
+	(do_auto_save_eh): Clear it.
+	(Fdo_auto_save): Catch all errors, not just file errors, so
+	that the var is always cleared.
+
 2011-12-28  Kenichi Handa  <handa <at> m17n.org>
 
 	* coding.c (Fdefine_coding_system_internal): Make an utf-8 base

=== modified file 'src/fileio.c'
--- src/fileio.c	2011-12-17 17:00:49 +0000
+++ src/fileio.c	2011-12-29 20:44:31 +0000
@@ -90,6 +90,9 @@
 /* Nonzero during writing of auto-save files */
 static int auto_saving;
 
+/* Nonzero umask during creation of auto-save directories */
+static int auto_saving_dir_umask;
+
 /* Set by auto_save_1 to mode of original file so Fwrite_region will create
    a new file with the same mode as the original */
 static int auto_save_mode_bits;
@@ -2062,7 +2065,7 @@
 #ifdef WINDOWSNT
   if (mkdir (dir) != 0)
 #else
-  if (mkdir (dir, 0777) != 0)
+  if (mkdir (dir, 0777 & ~auto_saving_dir_umask) != 0)
 #endif
     report_file_error ("Creating directory", list1 (directory));
 
@@ -5205,16 +5208,18 @@
 static Lisp_Object
 do_auto_save_make_dir (Lisp_Object dir)
 {
-  Lisp_Object mode;
+  Lisp_Object result;
 
-  call2 (Qmake_directory, dir, Qt);
-  XSETFASTINT (mode, 0700);
-  return Fset_file_modes (dir, mode);
+  auto_saving_dir_umask = 077;
+  result = call2 (Qmake_directory, dir, Qt);
+  auto_saving_dir_umask = 0;
+  return result;
 }
 
 static Lisp_Object
 do_auto_save_eh (Lisp_Object ignore)
 {
+  auto_saving_dir_umask = 0;
   return Qnil;
 }
 
@@ -5282,7 +5287,7 @@
 	  dir = Ffile_name_directory (listfile);
 	  if (NILP (Ffile_directory_p (dir)))
 	    internal_condition_case_1 (do_auto_save_make_dir,
-				       dir, Fcons (Fcons (Qfile_error, Qnil), Qnil),
+				       dir, Qt,
 				       do_auto_save_eh);
 	  UNGCPRO;
 	}

Message #10 received at 10400-done <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: 10400-done <at> debbugs.gnu.org, 10401-done <at> debbugs.gnu.org
Subject: patch installed
Date: Sat, 07 Jan 2012 12:06:09 -0800

I installed this patch into the Emacs trunk as part of
bzr 106821 and am marking the bug as done.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.