mirror of
https://github.com/uutils/coreutils.git
synced 2026-05-06 07:26:38 -04:00
Sylvestre Ledru
681030bca3
cp previously created the destination with mode 0o666 masked by umask (typically 0o644), then later applied the final permissions via set_permissions. In a shared directory like /tmp this opened an observable window where another user could open the destination with the intermediate broad mode before cp narrowed it, leaking file contents that were intended to stay private. Create dest with 0o600 initially in every non-symlink code path — clone, sparse_copy, sparse_copy_without_hole, fs_copy, the stream path, and the non-Linux fs::copy fallback. The existing set_permissions call in copy_file applies the real final mode after the content is written, so user-visible end state is unchanged; only the intermediate mode is tightened. Matches GNU cp. Extend `util/check-safe-traversal.sh` with a cp strace check that asserts the destination openat carries mode 0600 so a future change that reintroduces 0666 fails the smoke test.