From fa4cb04a00a14eec667087c819195bf1467cb5b0 Mon Sep 17 00:00:00 2001
From: Edwin Wong <edwinwong@google.com>
Date: Tue, 2 Feb 2016 18:13:14 -0800
Subject: [PATCH] Set umask to ensure sensitive files are only accessible by
 owner.

[Merge of http://go/wvgerrit/16626]
[Cherrypick from http://go/ag/858552 to nyc-dev branch]

Setting umask to ensure only owner can access sensitive files.
Fixes request_license_test which creates directories and files
accessible by group and others.

bug: 26567162
Change-Id: I63553ec9210f3a4c160cd4c4f2a49c9e0a4157db
---
 libwvdrmengine/cdm/src/file_store.cpp | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libwvdrmengine/cdm/src/file_store.cpp b/libwvdrmengine/cdm/src/file_store.cpp
index 131ebe5e..ceb906e2 100644
--- a/libwvdrmengine/cdm/src/file_store.cpp
+++ b/libwvdrmengine/cdm/src/file_store.cpp
@@ -48,6 +48,8 @@ File::~File() {
 bool File::Open(const std::string& name, int flags) {
   std::string open_flags;
 
+  // ensure only owners has access
+  mode_t old_mask = umask(077);
   if (((flags & File::kTruncate) && Exists(name)) ||
       ((flags & File::kCreate) && !Exists(name))) {
     FILE* fp = fopen(name.c_str(), "w+");
@@ -67,6 +69,7 @@ bool File::Open(const std::string& name, int flags) {
     LOGW("File::Open: fopen failed: %d", errno);
   }
   impl_->file_path_ = name;
+  umask(old_mask);
   return impl_->file_ != NULL;
 }
 
@@ -253,7 +256,7 @@ bool File::CreateDirectory(std::string path) {
   size_t pos = path.find(kDirectoryDelimiter, 1);
   while (pos < size) {
     path[pos] = '\0';
-    if (mkdir(path.c_str(), 0775) != 0) {
+    if (mkdir(path.c_str(), 0700) != 0) {
       if (errno != EEXIST) {
         LOGW("File::CreateDirectory: mkdir failed: %d\n", errno);
         return false;
@@ -264,7 +267,7 @@ bool File::CreateDirectory(std::string path) {
   }
 
   if (path[size - 1] != kDirectoryDelimiter) {
-    if (mkdir(path.c_str(), 0775) != 0) {
+    if (mkdir(path.c_str(), 0700) != 0) {
       if (errno != EEXIST) {
         LOGW("File::CreateDirectory: mkdir failed: %d\n", errno);
         return false;