#783192 xorg: /etc/X11/Xsession accidentally sets the umask to 077

Package:
xorg
Source:
xorg
Description:
X.Org X Window System
Submitter:
Simon Ruggier
Date:
2015-04-25 07:51:05 UTC
Severity:
normal
#783192#5
Date:
2015-04-23 17:12:18 UTC
From:
To:
Hi, I noticed today that my umask is 077 for some reason, which happens to be a
problem for me. I grepped /etc to see where this could be coming from, and
found this line in /etc/X11/Xsession:
if (umask 077 && touch "$ERRFILE") 2> /dev/null && [ -w "$ERRFILE" ] &&

I've since confirmed that that's the cause of the problem. Here's the commit
that added this:
commit 8b2df98c792aa52f181624206d9ed9331eaba5a8
Author: Julien Cristau <jcristau@debian.org>
Date:   Tue Feb 20 10:12:25 2007 +0100

    debian/local/Xsession: set temporary umask when creating $ERRFILE.

    Thanks to Timo Aaltonen for pointing out this change in the Ubuntu package.
    Reference: CVE-2006-5214.

We can see that the original intent for this change was that it be a
temporary change to umask. However, it doesn't seem to work out that way. I've
made a small change to fix the issue, confirmed that it makes a difference on
my system, and created a git commit out of it. See the attached patch file.

Thanks,
Simon
#783192#10
Date:
2015-04-25 07:42:10 UTC
From:
To:
How would that happen?  We set umask in a subshell, the original shell
shouldn't be affected...

Cheers,
Julien