From d3c244ca1853fb9d0fa07cbe26fd3f217a26c96c Mon Sep 17 00:00:00 2001 From: Acts1631 Date: Fri, 3 Jul 2026 19:31:17 -0400 Subject: [PATCH] checkpoint: create checkpoint file with 0600 instead of 0644 checkpoint_save() opened the checkpoint file with group and other read permissions. The checkpoint file contains the source and destination paths of files being transferred, which can leak information to other local users on shared systems. Restrict the mode to owner read/write only, since the file only needs to be read back by the same user during a -R resume. --- src/checkpoint.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/checkpoint.c b/src/checkpoint.c index d81e08d..52ff60c 100644 --- a/src/checkpoint.c +++ b/src/checkpoint.c @@ -233,8 +233,7 @@ int checkpoint_save(const char *pathname, int dir, const char *user, const char unsigned int i, nr_paths, nr_chunks; int fd, ret; - fd = open(pathname, O_WRONLY | O_CREAT | O_TRUNC, - S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH); + fd = open(pathname, O_WRONLY | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR); if (fd < 0) { priv_set_errv("open: %s: %s", pathname, strerrno()); return -1;