[OTR-dev] pidgin-otr: mode 600 instead of 644

[Caspar Clemens Mierau]

--Rn7IEEq3VEzCw+ji
Content-Type: multipart/mixed; boundary="PpAOPzA3dXsRhoo+"
Content-Disposition: inline


--PpAOPzA3dXsRhoo+
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi,

after reading

https://bugs.launchpad.net/ubuntu/+source/pidgin/+bug/156204

I checked the .purple/otr.* files created by pidgin-otr. They have a
mode 644 which is at least for otr.private_key a security issue and
breaks the design of .purple which actually makes files 0600.

I wrote a small six line patch and successfully applied and tested it.
Would you please check it and consider applying it to your upstream
code?

Patch is attached.

Best,

Caspar Clemens Mierau


--=20
Caspar Clemens Mierau
 Dipl.-Kult. (Medien)
 official "Ubuntu member"
 ubuntu Deutschland e.V.
 Ubuntu Berlin
 c-base e.V.


--PpAOPzA3dXsRhoo+
Content-Type: text/x-diff; charset=utf-8
Content-Disposition: attachment; filename="pidgin-otr-umask.diff"
Content-Transfer-Encoding: quoted-printable

--- otr-plugin.c.old	2008-06-17 13:24:57.000000000 +0200
+++ otr-plugin.c	2008-06-17 13:46:58.000000000 +0200
@@ -154,6 +154,7 @@
 	const char *protocol)
 {
     OtrgDialogWaitHandle waithandle;
+    mode_t mask;
     FILE *privf;
=20
     gchar *privkeyfile =3D g_build_filename(purple_user_dir(), PRIVKEYFNAM=
E, NULL);
@@ -161,7 +162,9 @@
 	fprintf(stderr, _("Out of memory building filenames!\n"));
 	return;
     }
+    mask =3D umask (0077);
     privf =3D g_fopen(privkeyfile, "w+b");
+    umask (mask);
     g_free(privkeyfile);
     if (!privf) {
 	fprintf(stderr, _("Could not write private key file\n"));
@@ -597,9 +600,12 @@
 /* Write the fingerprints to disk. */
 void otrg_plugin_write_fingerprints(void)
 {
+    mode_t mask;
     FILE *storef;
     gchar *storefile =3D g_build_filename(purple_user_dir(), STOREFNAME, N=
ULL);
+    mask =3D umask (0077);
     storef =3D g_fopen(storefile, "wb");
+    umask (mask);
     g_free(storefile);
     if (!storef) return;
     otrl_privkey_write_fingerprints_FILEp(otrg_plugin_userstate, storef);

--PpAOPzA3dXsRhoo+--

--Rn7IEEq3VEzCw+ji
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIV6tKdbVIHJiaHn8RAuLpAJ4gHvCq3pASpOpe661d4KrKDZI6VQCeL7Ly
hB2d2Bv5MD0xdi7KM8yLEtg=
=vdEb
-----END PGP SIGNATURE-----

--Rn7IEEq3VEzCw+ji--