patches/0003-Backport-keyfile-settings-Use-tighter-permissions.patch

From 9d820c9ba0cdef65c981cd2f13e0c5929f7ec529 Mon Sep 17 00:00:00 2001
From: Zong-Cing Lin <zclin@google.com>
Date: Wed, 26 Jan 2022 11:34:51 +0800
Subject: [PATCH 3/3] Backport "keyfile settings: Use tighter permissions"

https://gitlab.gnome.org/GNOME/glib/-/commit/5e4da714f00f6bfb2ccd6d73d61329c6f3a08429
It's for CVE-2019-13012

diff --git a/gio/gkeyfilesettingsbackend.c b/gio/gkeyfilesettingsbackend.c
index 6601eba68..7d0a49283 100644
--- a/gio/gkeyfilesettingsbackend.c
+++ b/gio/gkeyfilesettingsbackend.c
@@ -91,7 +91,8 @@ g_keyfile_settings_backend_keyfile_write (GKeyfileSettingsBackend *kfsb)
 
   contents = g_key_file_to_data (kfsb->keyfile, &length, NULL);
   g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE,
-                           G_FILE_CREATE_REPLACE_DESTINATION,
+                           G_FILE_CREATE_REPLACE_DESTINATION |
+                           G_FILE_CREATE_PRIVATE,
                            NULL, NULL, NULL);
 
   compute_checksum (kfsb->digest, contents, length);
@@ -625,6 +626,7 @@ g_keyfile_settings_backend_new (const gchar *filename,
                                 const gchar *root_group)
 {
   GKeyfileSettingsBackend *kfsb;
+  gchar *dir_path;
 
   g_return_val_if_fail (filename != NULL, NULL);
   g_return_val_if_fail (root_path != NULL, NULL);
@@ -638,7 +640,9 @@ g_keyfile_settings_backend_new (const gchar *filename,
 
   kfsb->file = g_file_new_for_path (filename);
   kfsb->dir = g_file_get_parent (kfsb->file);
-  g_file_make_directory_with_parents (kfsb->dir, NULL, NULL);
+  dir_path = g_file_get_path(kfsb->dir);
+  g_mkdir_with_parents (dir_path, 0700);
+  g_free(dir_path);
 
   kfsb->file_monitor = g_file_monitor_file (kfsb->file, 0, NULL, NULL);
   kfsb->dir_monitor = g_file_monitor_file (kfsb->dir, 0, NULL, NULL);
-- 
2.35.0.rc0.227.g00780c9af4-goog