From: Andreas Stieger <astieger@suse.com>
Date: Mon, 7 Nov 2016 09:37:22 +0000 (+0100)
Subject: dracut.sh: create the initramfs non-world readable also if early cpio is used
X-Git-Tag: 045~89
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0db98910a11c12a454eac4c8e86dc7a7bbc764a4;p=thirdparty%2Fdracut.git

dracut.sh: create the initramfs non-world readable also if early cpio is used

Fixes: 5f2c30d9bcd614d546d5c55c6897e33f88b9ab90
Previously fixed CVE-2012-4453: e1b48995c26c4f06d1a718539cb1bd5b0179af91

Signed-off-by: Andreas Stieger <astieger@suse.com>
---

diff --git a/dracut.sh b/dracut.sh
index 40ca08f65..2d79bbcc1 100755
--- a/dracut.sh
+++ b/dracut.sh
@@ -1700,7 +1700,7 @@ if [[ $create_early_cpio = yes ]]; then
 
     # The microcode blob is _before_ the initramfs blob, not after
     if ! (
-            cd "$early_cpio_dir/d"
+            umask 077; cd "$early_cpio_dir/d"
             find . -print0 | sort -z \
                 | cpio ${CPIO_REPRODUCIBLE:+--reproducible} --null $cpio_owner_root -H newc -o --quiet > "${DRACUT_TMPDIR}/initramfs.img"
         ); then