From owner-freebsd-bugs  Thu Feb  6 13:30:07 1997
Return-Path: <owner-bugs>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id NAA06757
          for bugs-outgoing; Thu, 6 Feb 1997 13:30:07 -0800 (PST)
Received: (from gnats@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id NAA06750;
          Thu, 6 Feb 1997 13:30:04 -0800 (PST)
Resent-Date: Thu, 6 Feb 1997 13:30:04 -0800 (PST)
Resent-Message-Id: <199702062130.NAA06750@freefall.freebsd.org>
Resent-From: gnats (GNATS Management)
Resent-To: freebsd-bugs
Resent-Reply-To: FreeBSD-gnats@freefall.FreeBSD.org, pst@Shockwave.COM
Received: from precipice.shockwave.com (ppp-206-170-5-34.rdcy01.pacbell.net [206.170.5.34])
          by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id NAA06448
          for <FreeBSD-gnats-submit@freebsd.org>; Thu, 6 Feb 1997 13:24:53 -0800 (PST)
Received: (from pst@localhost) by precipice.shockwave.com (8.8.4/8.7.3) id NAA01371; Thu, 6 Feb 1997 13:24:44 -0800 (PST)
Message-Id: <199702062124.NAA01371@precipice.shockwave.com>
Date: Thu, 6 Feb 1997 13:24:44 -0800 (PST)
From: Paul Traina <pst@Shockwave.COM>
Reply-To: pst@Shockwave.COM
To: FreeBSD-gnats-submit@freebsd.org
X-Send-Pr-Version: 3.2
Subject: kern/2680: bind of a local domain socket does not respect umask
Sender: owner-bugs@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk


>Number:         2680
>Category:       kern
>Synopsis:       bind of a local domain socket does not respect umask
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Feb  6 13:30:02 PST 1997
>Last-Modified:
>Originator:     Paul Traina
>Organization:
>Release:        FreeBSD 3.0-CURRENT i386
>Environment:

FreeBSD -current and 2.x

>Description:

	Unix domain sockets are always created with mode ACCESSPERMS.
	This is incorrect, they should be created with ACCESSPERMS & umask.

	This is a critical flaw, because there is no way to avoid a
	race condition even if you immediately chmod() the socket after
	creation.


>How-To-Repeat:

	umask(022);
	bind to a domain socket

	ls -l path

>Fix:

	In uipc_usrreq.c, vattr.va_mode is set to ACCESSPERMS.
	It should be set to ACCESSPERMS & current umask if the uap is
	available (is it always available at this point?)
>Audit-Trail:
>Unformatted: