close a security hole relating to a world-readable DEADJOE file; from FreeBSD

This commit is contained in:
brad 1999-08-30 15:07:17 +00:00
parent 4113ecb19e
commit a3a89a88f5
2 changed files with 32 additions and 25 deletions

View File

@ -1,22 +1,21 @@
# $OpenBSD: Makefile,v 1.10 1999/04/01 06:20:11 brad Exp $
# $OpenBSD: Makefile,v 1.11 1999/08/30 15:07:17 brad Exp $
DISTNAME= joe2.8
PKGNAME= joe-2.8
CATEGORIES= editors
MAINTAINER= ports@openbsd.org
MASTER_SITES= ftp://ftp.std.com/src/editors/
EXTRACT_SUFX= .tar.Z
MAINTAINER= ports@openbsd.org
WRKSRC= ${WRKDIR}/joe
ALL_TARGET= joe
MAKE_ENV+= SYS_JOERC=/etc/joe TERMINFO=1
MAKE_ENV+= SYS_JOERC="/etc/joe" TERMINFO="1"
do-install:
${INSTALL_PROGRAM} ${WRKSRC}/joe ${PREFIX}/bin
cd ${PREFIX}/bin; \
@cd ${PREFIX}/bin; \
${LN} -sf joe jmacs; \
${LN} -sf joe jpico; \
${LN} -sf joe jstar; \

View File

@ -1,19 +1,27 @@
*** b.c.orig Thu Apr 16 17:59:05 1998
--- b.c Thu Apr 16 17:59:39 1998
***************
*** 1630,1636 ****
if(x==1)
{
char *z;
! s=getenv("HOME");
z=vsncpy(NULL,0,sz(s));
z=vsncpy(z,sLEN(z),sz(n+x));
vsrm(n);
--- 1630,1636 ----
if(x==1)
{
char *z;
! s=(char *)getenv("HOME");
z=vsncpy(NULL,0,sz(s));
z=vsncpy(z,sLEN(z),sz(n+x));
vsrm(n);
--- b.c.orig Fri Jan 20 01:38:25 1995
+++ b.c Mon Aug 30 09:04:50 1999
@@ -21,6 +21,7 @@
#include <pwd.h>
#endif
#include <errno.h>
+#include <sys/types.h>
#include "config.h"
#include "blocks.h"
@@ -1630,7 +1631,7 @@
if(x==1)
{
char *z;
- s=getenv("HOME");
+ s=(char *)getenv("HOME");
z=vsncpy(NULL,0,sz(s));
z=vsncpy(z,sLEN(z),sz(n+x));
vsrm(n);
@@ -1990,6 +1991,7 @@
{
long tim=time(0);
B *b;
+ mode_t mask=umask(077); /* no access to DEADJOE for others */
FILE *f=fopen("DEADJOE","a");
fprintf(f,"\n*** Modified files in JOE when it aborted on %s",ctime(&tim));
if(sig) fprintf(f,"*** JOE was aborted by signal %d\n",sig);