CVE-2013-4476: samba-tool provision: create ${private_dir}/tls with mode 0700

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10234

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/python/samba/provision/__init__.py b/python/samba/provision/__init__.py
index e0b3d220bcc4764d3b6083cebd3faca3d9111db9..0a54af8ad20686f8150d5a32a3e6e7a3e8b7a5d7 100644 (file)
--- a/python/samba/provision/__init__.py
+++ b/python/samba/provision/__init__.py
@@ -2014,7 +2014,7 @@ def provision(logger, session_info, credentials, smbconf=None,
     if not os.path.exists(paths.private_dir):
         os.mkdir(paths.private_dir)
     if not os.path.exists(os.path.join(paths.private_dir, "tls")):
-        os.mkdir(os.path.join(paths.private_dir, "tls"))
+        os.makedirs(os.path.join(paths.private_dir, "tls"), 0700)
     if not os.path.exists(paths.state_dir):
         os.mkdir(paths.state_dir)