Files
nginx-unit/src
Andrew Clayton 29471c8d32 Set a safer umask(2) when running as a daemon.
When running as a daemon. unit currently sets umask(0), i.e no umask.
This is resulting in various directories being created with a mode of
0777, e.g

  rwxrwxrwx

this is currently affecting cgroup and rootfs directories, which are
being created with a mode of 0777, and when running as a daemon as there
is no umask to restrict the permissions.

This also affects the language modules (the umask is inherited over
fork(2)) whereby unless something explicitly sets a umask, files and
directories will be created with full permissions, 0666 (rw-rw-rw-)/
0777 (rwxrwxrwx) respectively.

This could be an unwitting security issue.

My original idea was to just remove the umask(0) call and thus inherit
the umask from the executing shell/program.

However there was some concern about just inheriting whatever umask was
in effect.

Alex suggested that rather than simply removing the umask(0) call we
change it to a value of 022 (which is a common default), which will
result in directories and files with permissions at most of 0755
(rwxr-xr-x) & 0644 (rw-r--r--).

If applications need some other umask set, they can (as they always have
been able to) set their own umask(2).

Suggested-by: Alejandro Colomar <alx.manpages@gmail.com>
Reviewed-by: Liam Crilly <liam@nginx.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2023-02-23 12:01:14 +00:00
..
2022-12-14 11:29:49 +01:00
2020-08-13 02:46:54 +03:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2021-08-03 13:59:27 +03:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2020-05-28 14:57:41 +01:00
2020-03-09 16:28:25 +00:00
2022-05-03 12:11:14 +02:00
2022-11-19 02:27:22 +00:00
2022-11-19 02:27:22 +00:00
2017-01-17 20:00:00 +03:00
2022-05-03 12:11:14 +02:00
2017-01-17 20:00:00 +03:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2021-08-03 13:59:27 +03:00
2017-01-23 19:56:03 +03:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2017-01-17 20:00:00 +03:00
2017-01-17 20:00:00 +03:00
2022-04-26 12:38:48 +02:00
2017-01-17 20:00:00 +03:00
2019-03-11 17:31:59 +03:00
2022-05-03 12:11:14 +02:00
2019-11-14 16:39:54 +03:00
2022-11-20 23:16:51 +08:00
2022-11-20 23:16:51 +08:00
2022-11-20 23:16:51 +08:00
2022-11-20 23:16:51 +08:00
2022-08-18 15:43:03 +02:00
2017-08-28 10:20:40 +03:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2021-03-24 08:05:07 +03:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2017-01-17 20:00:00 +03:00
2022-05-03 12:11:14 +02:00
2017-03-09 18:03:27 +03:00
2017-01-17 20:00:00 +03:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2020-08-13 02:46:54 +03:00
2017-01-17 20:00:00 +03:00
2022-07-18 19:09:30 +02:00
2022-07-18 19:09:30 +02:00
2017-01-17 20:00:00 +03:00
2019-03-11 17:31:59 +03:00
2022-10-28 03:18:33 +01:00
2022-08-29 14:27:09 +08:00
2017-03-14 19:03:49 +03:00
2022-12-01 21:05:39 +00:00
2017-01-17 20:00:00 +03:00
2022-05-03 12:11:14 +02:00
2017-01-17 20:00:00 +03:00
2017-01-17 20:00:00 +03:00
2022-11-20 23:16:51 +08:00
2017-01-17 20:00:00 +03:00
2017-01-17 20:00:00 +03:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2022-08-11 18:43:12 +02:00
2022-05-03 12:11:14 +02:00
2017-01-17 20:00:00 +03:00
2022-05-03 12:11:14 +02:00
2017-01-17 20:00:00 +03:00
2022-08-29 14:32:20 +08:00
2017-01-17 20:00:00 +03:00
2017-01-17 20:00:00 +03:00
2022-05-03 12:11:14 +02:00
2017-01-27 11:35:11 +03:00
2022-05-03 12:11:14 +02:00
2022-05-03 12:11:14 +02:00
2017-01-17 20:00:00 +03:00
2022-05-03 12:11:14 +02:00
2019-03-11 17:31:59 +03:00
2018-06-25 16:51:47 +03:00
2019-03-11 17:31:59 +03:00
2019-11-14 16:39:54 +03:00
2018-08-06 17:27:33 +03:00
2018-08-06 17:27:33 +03:00
2022-12-08 13:45:01 +00:00
2020-03-06 18:28:54 +03:00
2022-11-22 10:13:18 +08:00
2022-05-03 12:11:14 +02:00
2019-10-10 19:42:41 +03:00
2018-02-07 15:34:42 +03:00
2022-05-03 12:11:14 +02:00