Re: Bug#832908: mongodb: CVE-2016-6494: world-readable .dbshell history file: LTS update and upgrade handling

[Chris Lamb <lamby@debian.org>]

> Here is the working patch (attached).

Out of interest, why:

+    mode_t prev_mask = umask(0022);
+    // Make sure this file is not readable by others
+    umask(prev_mask | S_IROTH | S_IWOTH | S_IXOTH);
     FILE *fp = fopen(filename,"w");

.. over, say:

+    // Make sure this file is not readable by others
+    mode_t prev_mask = umask(S_IXUSR|S_IRWXG|S_IRWXO);
     FILE *fp = fopen(filename,"w");
+    umask(prev_mask);

We don't really want to change the umask for the entire process.
Or at least, we don't know the ramifications of that so better to
keep it isolated to just this bit?


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-