2 files changed, 8 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index 9f6fc7058..f9f2166b1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,9 @@
    des.no
  - (djm) [configure.ac openbsd-compat/bsd-misc.c openbsd-compat/bsd-misc.h]
    Add a usleep replacement for platforms that lack it; ok dtucker
+ - (djm) [session.c] FreeBSD needs setusercontext(..., LOGIN_SETUMASK) to
+   occur after UID switch; patch from John Marshall via des AT des.no;
+   ok dtucker@
 
 20120312
  - (dtucker) [regress/Makefile regress/cipher-speed.sh regress/test-exec.sh]
diff --git a/session.c b/session.c
index 643e7fc59..19eaa20c3 100644
--- a/session.c
+++ b/session.c
@@ -1520,6 +1520,11 @@ do_setusercontext(struct passwd *pw)
                         perror("unable to set user context (setuser)");
                         exit(1);
                 }
+                /* 
+                 * FreeBSD's setusercontext() will not apply the user's
+                 * own umask setting unless running with the user's UID.
+                 */
+                (void) setusercontext(lc, pw, pw->pw_uid, LOGIN_SETUMASK);
 #else
                 /* Permanently switch to the desired uid. */
                 permanently_set_uid(pw);