comparison file/file.go @ 9:e58bfc7fc207

Make multipass files default all-readable.
author Paul Fisher <paul@pfish.zone>
date Sun, 25 Oct 2015 10:45:32 -0400
parents c18bc7b9d1d9
children 1246b4b9028b
comparison
equal deleted inserted replaced
8:4db389f948c9 9:e58bfc7fc207
141 141
142 func openWriteHandle(tempName, fileName string) (*writeHandle, error) { 142 func openWriteHandle(tempName, fileName string) (*writeHandle, error) {
143 h := new(writeHandle) 143 h := new(writeHandle)
144 h.tempName = tempName 144 h.tempName = tempName
145 h.fileName = fileName 145 h.fileName = fileName
146 // Open the output file, readable only by the current user. 146 // Open the output file, readable by everybody, but only if it doesn't exist.
147 // This prevents race conditions.
147 oldUmask := unix.Umask(077) 148 oldUmask := unix.Umask(077)
148 tempFile, err := os.Create(tempName) 149 tempFile, err := os.OpenFile(tempName, os.O_CREATE | os.O_EXCL | os.O_WRONLY | os.O_SYNC, 0600)
149 unix.Umask(oldUmask) 150 unix.Umask(oldUmask)
150 if err != nil { 151 if err != nil {
151 return nil, err 152 return nil, err
152 } 153 }
153 h.tempFile = tempFile 154 h.tempFile = tempFile
176 } 177 }
177 if err := h.tempFile.Chmod(inStat.Mode()); err != nil { 178 if err := h.tempFile.Chmod(inStat.Mode()); err != nil {
178 h.bail() 179 h.bail()
179 return nil, err 180 return nil, err
180 } 181 }
181 } 182 } else {
182 // TODO(pfish): If there is no input file, set the right permissions + group on the output file. 183 // TODO(pfish): Restrict ACL to only multipass authenticators.
184 if err := h.tempFile.Chmod(0644); err != nil {
185 h.bail()
186 return nil, err
187 }
188 }
183 h.writer = bufio.NewWriter(h.tempFile) 189 h.writer = bufio.NewWriter(h.tempFile)
184 if _, err := h.writer.WriteString(Banner + "\n"); err != nil { 190 if _, err := h.writer.WriteString(Banner + "\n"); err != nil {
185 return nil, err 191 return nil, err
186 } 192 }
187 return h, nil 193 return h, nil