install: fix security race

* NEWS: Document this.

diff --git a/NEWS b/NEWS
index 713f761e81a05cc9f0f865cead1e8c2d032888d6..15fddd4902800370bab32817ecb952ba2bdeef5c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,9 @@ GNU coreutils NEWS                                    -*- outline -*-
   Instead, cut now fails and emits an appropriate diagnostic.
   [This bug was present in "the beginning".]
 
+  install -m M SOURCE DEST no longer has a race condition where DEST's
+  permissions are temporarily derived from SOURCE instead of from M.
+
   pr -n no longer crashes when passed values >= 32.  Also line numbers are
   consistently padded with spaces, rather than with zeros for certain widths.
   [bug introduced in TEXTUTILS-1_22i]