move umask from policy to Restrictions (since it affects the after-authentication context)

Author: squell

src/common/context.rs

@@ -96,7 +96,7 @@ impl Context {
             process: Process::new(),
             use_pty: true,
             noexec: false,
-            umask: policy.umask(),
+            umask: Umask::Preserve,
         })
     }
 

src/exec/mod.rs

@@ -50,6 +50,7 @@ impl SpawnNoexecHandler {
 }
 
 #[derive(Debug, Copy, Clone)]
+#[cfg_attr(test, derive(PartialEq))]
 #[repr(u32)]
 pub enum Umask {
     /// Keep the umask of the parent process.

src/sudo/env/environment.rs

@@ -280,6 +280,7 @@ mod tests {
                         chdir: crate::sudoers::DirChange::Strict(None),
                         trust_environment: false,
                         use_pty: true,
+                        umask: crate::exec::Umask::Preserve,
                         #[cfg(feature = "apparmor")]
                         apparmor_profile: None,
                         noexec: false,

src/sudo/env/tests.rs

@@ -172,6 +172,7 @@ fn test_environment_variable_filtering() {
                 use_pty: true,
                 chdir: crate::sudoers::DirChange::Strict(None),
                 trust_environment: false,
+                umask: crate::exec::Umask::Preserve,
                 #[cfg(feature = "apparmor")]
                 apparmor_profile: None,
                 noexec: false,

src/sudo/pipeline.rs

@@ -238,6 +238,7 @@ fn apply_policy_to_context(
     // could be needed, but here we copy these -- perhaps we should split up the Context type
     context.use_pty = controls.use_pty;
     context.noexec = controls.noexec;
+    context.umask = controls.umask;
 
     Ok(())
 }

src/sudoers/mod.rs

@@ -15,7 +15,6 @@ use std::path::{Path, PathBuf};
 
 use crate::common::resolve::resolve_path;
 use crate::defaults;
-use crate::exec::Umask;
 use crate::log::auth_warn;
 use crate::system::interface::{GroupId, UnixGroup, UnixUser, UserId};
 use crate::system::{self, can_execute};
@@ -318,26 +317,6 @@ impl Sudoers {
 
         None
     }
-
-    pub(crate) fn umask(&self) -> Umask {
-        if self.settings.umask() == 0o777 {
-            Umask::Preserve
-        } else if self.settings.umask_override() {
-            Umask::Override(
-                self.settings
-                    .umask()
-                    .try_into()
-                    .expect("the umask parser should have prevented overflow"),
-            )
-        } else {
-            Umask::Extend(
-                self.settings
-                    .umask()
-                    .try_into()
-                    .expect("the umask parser should have prevented overflow"),
-            )
-        }
-    }
 }
 
 // a `take_while` variant that does not consume the first non-matching item

src/sudoers/policy.rs

@@ -4,6 +4,7 @@ use super::Judgement;
 use crate::common::{
     SudoPath, HARDENED_ENUM_VALUE_0, HARDENED_ENUM_VALUE_1, HARDENED_ENUM_VALUE_2,
 };
+use crate::exec::Umask;
 use crate::sudoers::ast::{ExecControl, Tag};
 use crate::system::{time::Duration, Hostname, User};
 /// Data types and traits that represent what the "terms and conditions" are after a succesful
@@ -59,6 +60,7 @@ pub struct Restrictions<'a> {
     pub env_check: &'a HashSet<String>,
     pub chdir: DirChange<'a>,
     pub path: Option<&'a str>,
+    pub umask: Umask,
     #[cfg(feature = "apparmor")]
     pub apparmor_profile: Option<String>,
 }
@@ -109,6 +111,20 @@ impl Judgement {
                         Some(super::ChDir::Path(path)) => DirChange::Strict(Some(path)),
                     },
                     path: self.settings.secure_path(),
+                    umask: {
+                        let mask = self
+                            .settings
+                            .umask()
+                            .try_into()
+                            .expect("the umask parser should have prevented overflow");
+                        if self.settings.umask() == 0o777 {
+                            Umask::Preserve
+                        } else if self.settings.umask_override() {
+                            Umask::Override(mask)
+                        } else {
+                            Umask::Extend(mask)
+                        }
+                    },
                     #[cfg(feature = "apparmor")]
                     apparmor_profile: tag
                         .apparmor_profile