[dak/master] debianqueued: add option for umask

[Ansgar Burchardt <ansgar@debian.org>]

The queued instance processing security uploads should not make them
world-readable on the upload host.
---
 tools/debianqueued-0.9/config-security-upload | 4 ++++
 tools/debianqueued-0.9/debianqueued           | 9 +++++++++
 2 files changed, 13 insertions(+)

diff --git a/tools/debianqueued-0.9/config-security-upload b/tools/debianqueued-0.9/config-security-upload
index 4c6d77f..a8ea6e5 100644
--- a/tools/debianqueued-0.9/config-security-upload
+++ b/tools/debianqueued-0.9/config-security-upload
@@ -72,6 +72,10 @@ $pidfile = "$queued_dir/run/pid";
 # upload method (ssh, copy, ftp)
 $upload_method = "copy";
 
+# default umask:
+#   copied files should *not* be world-readable for security uploads
+$umask = 0027;
+
 # name of target host (ignored on copy method)
 $target = "localhost";
 
diff --git a/tools/debianqueued-0.9/debianqueued b/tools/debianqueued-0.9/debianqueued
index ecd46b0..7d80a42 100755
--- a/tools/debianqueued-0.9/debianqueued
+++ b/tools/debianqueued-0.9/debianqueued
@@ -46,6 +46,11 @@ our $ssh_agent = "/usr/bin/ssh-agent";
 our $ssh_add   = "/usr/bin/ssh-add";
 our $mail      = "/usr/sbin/sendmail";
 
+# default umask:
+#   This is mostly for the "copy" upload method.  Logs, pidfile get
+#   explicit permissions via `chmod`.
+our $umask     = 0022;
+
 require "$conf::queued_dir/config";
 my $junk = $conf::debug;    # avoid spurious warnings about unused vars
 $junk = $conf::ssh_key_file;
@@ -70,6 +75,10 @@ $conf::target = "localhost" if $conf::upload_method eq "copy";
 
 package main;
 
+if (defined $conf::umask) {
+  umask $conf::umask;
+}
+
 ( $main::progname = $0 ) =~ s,.*/,,;
 
 ($main::hostname, undef, undef, undef, undef) = gethostbyname(hostname());
-- 
2.1.4