X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=src%2Fmonkeysphere;h=cb6c06c1907ac384a9450189bd2b82381f100994;hb=cabc89111693c8f928a7685f55a385ccf75daf86;hp=a25fd6a64257a780fc6628842f119218a1f198ee;hpb=5fadec09dcd44c4dcad657a0f3d96878b592b77b;p=monkeysphere.git

diff --git a/src/monkeysphere b/src/monkeysphere
index a25fd6a..cb6c06c 100755
--- a/src/monkeysphere
+++ b/src/monkeysphere
@@ -24,6 +24,9 @@ unset GREP_OPTIONS
 # default return code
 RETURN=0
 
+# set the file creation mask to be only owner rw
+umask 077
+
 ########################################################################
 # FUNCTIONS
 ########################################################################
@@ -47,10 +50,45 @@ EOF
 # generate a subkey with the 'a' usage flags set
 # FIXME: this needs some tweaking to clean it up
 gen_subkey(){
+    local keyLength
+    local keyExpire
     local keyID
     local gpgOut
     local userID
 
+    # set default key parameter values
+    keyLength=
+    keyExpire=
+
+    # get options
+    TEMP=$(getopt -o l:e: -l length:,expire: -n "$PGRM" -- "$@")
+
+    if [ $? != 0 ] ; then
+	exit 1
+    fi
+
+    # Note the quotes around `$TEMP': they are essential!
+    eval set -- "$TEMP"
+
+    while true ; do
+	case "$1" in
+	    -l|--length)
+		keyLength="$2"
+		shift 2
+		;;
+	    -e|--expire)
+		keyExpire="$2"
+		shift 2
+		;;
+	    --)
+		shift
+		;;
+            *)
+		break
+		;;
+	esac
+    done
+
     keyID="$1"
 
     gpgOut=$(gpg --quiet --fixed-list-mode --list-keys --with-colons \
@@ -78,11 +116,8 @@ gen_subkey(){
     fi
 
     # set subkey defaults
-    KEY_TYPE="RSA"
-    KEY_LENGTH=${KEY_LENGTH:-}
-    KEY_USAGE="auth"
     # prompt about key expiration if not specified
-    if [ -z "$KEY_EXPIRE" ] ; then
+    if [ -z "$keyExpire" ] ; then
 	cat <<EOF
 Please specify how long the key should be valid.
          0 = key does not expire
@@ -91,15 +126,15 @@ Please specify how long the key should be valid.
       <n>m = key expires in n months
       <n>y = key expires in n years
 EOF
-	while [ -z "$KEY_EXPIRE" ] ; do
-	    read -p "Key is valid for? (0) " KEY_EXPIRE
-	    if ! test_gpg_expire ${KEY_EXPIRE:=0} ; then
+	while [ -z "$keyExpire" ] ; do
+	    read -p "Key is valid for? (0) " keyExpire
+	    if ! test_gpg_expire ${keyExpire:=0} ; then
 		echo "invalid value"
-		unset KEY_EXPIRE
+		unset keyExpire
 	    fi
 	done
-    elif ! test_gpg_expire "$KEY_EXPIRE" ; then
-	failure "invalid key expiration value '$KEY_EXPIRE'."
+    elif ! test_gpg_expire "$keyExpire" ; then
+	failure "invalid key expiration value '$keyExpire'."
     fi
 
     # generate the list of commands that will be passed to edit-key
@@ -110,8 +145,8 @@ S
 E
 A
 Q
-$KEY_LENGTH
-$KEY_EXPIRE
+$keyLength
+$keyExpire
 save
 EOF
 )
@@ -166,44 +201,14 @@ COMMAND="$1"
 [ "$COMMAND" ] || failure "Type '$PGRM help' for usage."
 shift
 
-# unset option variables
-unset KEY_LENGTH
-unset KEY_EXPIRE
-
-# get options for key generation and add-certifier functions
-TEMP=$(getopt -o l:e: -l length:,expire: -n "$PGRM" -- "$@")
-
-if [ $? != 0 ] ; then
-    usage
-    exit 1
-fi
-
-# Note the quotes around `$TEMP': they are essential!
-eval set -- "$TEMP"
-
-while true ; do
-    case "$1" in
-	-l|--length)
-	    KEY_LENGTH="$2"
-	    shift 2
-	    ;;
-	-e|--expire)
-	    KEY_EXPIRE="$2"
-	    shift 2
-	    ;;
-	--)
-	    shift
-	    ;;
-        *)
-            break
-            ;;
-    esac
-done
-
 case $COMMAND in
     'update-known_hosts'|'update-known-hosts'|'k')
 	MODE='known_hosts'
 
+	if ! check_key_file_permissions "$USER" "$KNOWN_HOSTS" ; then
+	    failure "Improper permissions on known_hosts file."
+	fi
+
         # if hosts are specified on the command line, process just
         # those hosts
 	if [ "$1" ] ; then
@@ -227,7 +232,11 @@ case $COMMAND in
 
         # fail if the authorized_user_ids file is empty
 	if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then
-	    failure "$AUTHORIZED_USER_IDS is empty or does not exist."
+	    failure "authorized_user_ids file '$AUTHORIZED_USER_IDS' is empty or does not exist."
+	fi
+
+	if ! check_key_file_permissions "$USER" "$AUTHORIZED_USER_IDS" ; then
+	    failure "Improper permissions on authorized_user_ids file."
 	fi
 
 	# process authorized_user_ids file