8deaf04feb
Stefan Eissing
2026-03-30
Subject
fopen: for temp files, inherit permissions only for owner
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/curl_fopen.c+7 -0
| @@ -103,7 +103,14 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename, | |
| return CURLE_OK; | |
| } | |
| curlx_fclose(*fh); | |
| + | #ifdef HAVE_GETEUID |
| + | /* If the existing file is not owned by the user, do not inherit |
| + | * its permissions at the temp file created below. The permissions |
| + | * might be unsuitable for holding user private data. */ |
| + | if(sb.st_uid != geteuid()) |
| + | sb.st_mode = 0; |
| #endif | |
| + | #endif /* !_WIN32 */ |
| *fh = NULL; | |
| result = Curl_rand_alnum(data, randbuf, sizeof(randbuf)); | |