From c6806434e79079f4f9419c3ba4fec37efcaa1635 Mon Sep 17 00:00:00 2001 From: Cy Schubert Date: Tue, 18 Jan 2022 06:14:54 -0800 Subject: [PATCH] rc.d/ntp: Ensure ntpd.leap-seconds.list is readable by ntpd When a use sets umask in login.conf(5) to 027 or 077 a subsequently fetched /var/db/ntpd.leap-seconds.list will inherit the permissions allowed by the umask, resulting in a file that may not be readable ntpd running under the ntp account. This patch adds a umask command to preempt the umask in login.conf(5) prior to fetching a new copy of the leap-seconds file. PR: 261298 Reported by: Martin Waschbusch MFC after: 3 days --- libexec/rc/rc.d/ntpd | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libexec/rc/rc.d/ntpd b/libexec/rc/rc.d/ntpd index 8b32e3e19d5b..c1d2f52a01b7 100755 --- a/libexec/rc/rc.d/ntpd +++ b/libexec/rc/rc.d/ntpd @@ -221,6 +221,8 @@ ntpd_fetch_leapfile() { if ntpd_needfetch_leapfile ; then for url in $ntp_leapfile_sources ; do $verbose fetching $url + # Circumvent umask 027 and 077 in login.conf(5) + umask 022 fetch $ntp_leapfile_fetch_opts -o $_ntp_tmp_leapfile $url && break done ntp_ver_no_tmp=$(get_ntp_leapfile_ver $_ntp_tmp_leapfile)