- (dtucker) [auth-krb5.c gss-serv-krb5.c openbsd-compat/xmmap.c]

   Explicitly set umask for mkstemp; ok djm@

1 files changed, 5 insertions, 1 deletions

diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
index 6bd5830fb..91d87f798 100644
--- a/gss-serv-krb5.c
+++ b/gss-serv-krb5.c
@@ -134,11 +134,15 @@ ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
         {
                 int tmpfd;
                 char ccname[40];
+                mode_t old_umask;
 
                 snprintf(ccname, sizeof(ccname),
                     "FILE:/tmp/krb5cc_%d_XXXXXX", geteuid());
 
-                if ((tmpfd = mkstemp(ccname + strlen("FILE:"))) == -1) {
+                old_umask = umask(0177);
+                tmpfd = mkstemp(ccname + strlen("FILE:"));
+                umask(old_umask);
+                if (tmpfd == -1) {
                         logit("mkstemp(): %.100s", strerror(errno));
                         problem = errno;
                         return;