oss-security - Re: X server umask issue

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20091109162435.GH4499@patate.is-a-geek.org>
Date: Mon, 9 Nov 2009 17:24:35 +0100
From: Julien Cristau <jcristau@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: X server umask issue

On Mon, Nov  9, 2009 at 16:15:47 +0000, Steve Kemp wrote:

> On Mon Nov 09, 2009 at 11:09:55 -0500, Josh Bressers wrote:
> 
> > What I am wondering though, are there other files the X server creates that could
> > be an issue for this? I'm not aware of any, but I'm also not an expert by any
> > stretch of the imagination. Am I missing something else?
> 
>   /tmp/.X11-unix/* or /tmp/X0-lock might be worth checking.
> 
The socket is intentionally world-writable, and the lock is created with
    lfd = open(tmp, O_CREAT | O_EXCL | O_WRONLY, 0644);
and later
  (void) chmod(tmp, 0444);

Cheers,
Julien

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.