From e043fc7d0b68bedaabe236c2f2080a33bb967ee5 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Thu, 9 Sep 2004 14:16:02 +0000 Subject: [PATCH] * Set the umask to known value (0022). This is important in a setuid installation, since the calling user may have a more fascist umask (say, 0077), which would cause the store objects built by Nix to be unreadable to anyone other than the Nix user. --- src/libmain/shared.cc | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc index 7917407bb..a5c45d853 100644 --- a/src/libmain/shared.cc +++ b/src/libmain/shared.cc @@ -91,6 +91,12 @@ static void initAndRun(int argc, char * * argv) if (sigaction(SIGPIPE, &act, &oact)) throw SysError("ignoring SIGPIPE"); + /* There is no privacy in the Nix system ;-) At least not for + now. In particular, store objects should be readable by + everybody. This prevents nasty surprises when using a shared + store (with the setuid() hack). */ + umask(0022); + /* Process the NIX_LOG_TYPE environment variable. */ string lt = getEnv("NIX_LOG_TYPE"); if (lt != "") setLogType(lt);