<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Security: PulseAudio server weakens the umask"
href="https://bugs.freedesktop.org/show_bug.cgi?id=102060">102060</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Security: PulseAudio server weakens the umask
</td>
</tr>
<tr>
<th>Product</th>
<td>PulseAudio
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>daemon
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pulseaudio-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>klaus.kusche@computerix.info
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>pulseaudio-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>CC</th>
<td>lennart@poettering.net
</td>
</tr></table>
<p>
<div>
<pre>We have a strict umask 077 policy here, i.e. all files created under /home
must have 00 permissions for group and other.
However, in spite of its initial umask being 077, the pulseaudio daemon
creates files with permissions 644 in $HOME/.config/pulse.
A quick look into the source found a umask(0022); in src/daemon/main.c .
It may create files with more restrictive permissions than the umask says
(e.g. with 644 if the umask is 000), but it must not ignore the initial umask
or set its umask to something weaker than the initial umask,
and it must not create files with less restricive permissions than the umask!</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>