669. [bug] dnssec-keygen now makes the public key file

                        non-world-readable for symmetric keys. [RT #403]

diff --git a/lib/dns/sec/dst/dst_api.c b/lib/dns/sec/dst/dst_api.c
index a3a67871cbd5e5a93a6d1b10b7ac4b5544ea5457..47c8c6a0513c453ebd710fc8bea88203222a7eef 100644 (file)
--- a/lib/dns/sec/dst/dst_api.c
+++ b/lib/dns/sec/dst/dst_api.c
@@ -19,7 +19,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: dst_api.c,v 1.67.2.2 2001/04/10 01:10:21 gson Exp $
+ * $Id: dst_api.c,v 1.67.2.3 2001/05/10 21:12:36 gson Exp $
  */
 
 #include <config.h>
@@ -29,6 +29,7 @@
 #include <isc/buffer.h>
 #include <isc/dir.h>
 #include <isc/entropy.h>
+#include <isc/fsaccess.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/once.h>
@@ -1003,6 +1004,7 @@ write_public_key(const dst_key_t *key, const char *directory) {
        char class_array[10];
        isc_result_t ret;
        dns_rdata_t rdata = DNS_RDATA_INIT;
+       isc_fsaccess_t access;
 
        REQUIRE(VALID_KEY(key));
 
@@ -1055,6 +1057,15 @@ write_public_key(const dst_key_t *key, const char *directory) {
 
        fputc('\n', fp);
        fclose(fp);
+
+       if (key->func->issymmetric()) {
+               access = 0;
+               isc_fsaccess_add(ISC_FSACCESS_OWNER,
+                                ISC_FSACCESS_READ | ISC_FSACCESS_WRITE,
+                                &access);
+               (void)isc_fsaccess_set(filename, access);
+       }
+
        return (ISC_R_SUCCESS);
 }