Bug 5897

Summary: race condition on $HOME/.xsession-errors being readable
Product: xorg Reporter: Jeremy C. Reed <reed>
Component: App/xdmAssignee: Xorg Project Team <xorg-team>
Status: RESOLVED FIXED QA Contact:
Severity: critical    
Priority: high    
Version: 7.0.0   
Hardware: x86 (IA32)   
OS: NetBSD   
i915 platform: i915 features:
Bug Depends on:    
Bug Blocks: 5041    

Description Jeremy C. Reed 2006-02-16 03:27:33 UTC
This is from NetBSD's PR: xsrc/32804

Possible someone could open the $HOME/.xsession-errors" before it becomes

--- programs/xdm/config/Xsession.cpp.orig	2006-02-12 16:32:25.000000000 +0100
+++ programs/xdm/config/Xsession.cpp
@@ -6,9 +6,8 @@ XCOMM $XFree86: xc/programs/xdm/config/X
 XCOMM redirect errors to a file in user's home directory if we can
 for errfile in "$HOME/.xsession-errors" "${TMPDIR-/tmp}/xses-$USER"
-	if ( cp /dev/null "$errfile" 2> /dev/null )
+	if ( umask 077 && cp /dev/null "$errfile" 2> /dev/null )
-		chmod 600 "$errfile"
 		exec > "$errfile" 2>&1

I also emailed the xorg_security a couple days ago but no reply.

May I commit the above?
Comment 1 Jeremy C. Reed 2006-02-25 08:37:28 UTC
Committed fix to app/xdm/config/Xsession.cpp HEAD.
I am closing but didn't commit to monolithic.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.