RT2547: Tighten perms on generated privkey files

When generating a private key, try to make the output file be readable
only by the owner.  Put it in CHANGES file since it might be noticeable.

Add "int private" flag to apps that write private keys, and check that it's
set whenever we do write a private key.  Checked via assert so that this
bug (security-related) gets fixed.  Thanks to Viktor for help in tracing
the code-paths where private keys are written.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>

1 files changed, 8 insertions, 5 deletions

diff --git a/apps/genpkey.c b/apps/genpkey.c
index 7c8d551827..dbbedaa35e 100644
--- a/apps/genpkey.c
+++ b/apps/genpkey.c
@@ -105,6 +105,7 @@ int genpkey_main(int argc, char **argv)
     const EVP_CIPHER *cipher = NULL;
     OPTION_CHOICE o;
     int outformat = FORMAT_PEM, text = 0, ret = 1, rv, do_param = 0;
+    int private = 0;
 
     prog = opt_init(argc, argv, genpkey_options);
     while ((o = opt_next()) != OPT_EOF) {
@@ -125,7 +126,6 @@ int genpkey_main(int argc, char **argv)
         case OPT_OUT:
             outfile = opt_arg();
             break;
-
         case OPT_PASS:
             passarg = opt_arg();
             break;
@@ -171,6 +171,7 @@ int genpkey_main(int argc, char **argv)
     }
     argc = opt_num_rest();
     argv = opt_rest();
+    private = do_param ? 0 : 1;
 
     if (ctx == NULL)
         goto opthelp;
@@ -183,7 +184,7 @@ int genpkey_main(int argc, char **argv)
     if (!app_load_modules(NULL))
         goto end;
 
-    out = bio_open_default(outfile, "wb");
+    out = bio_open_owner(outfile, "wb", private);
     if (out == NULL)
         goto end;
 
@@ -206,11 +207,13 @@ int genpkey_main(int argc, char **argv)
 
     if (do_param)
         rv = PEM_write_bio_Parameters(out, pkey);
-    else if (outformat == FORMAT_PEM)
+    else if (outformat == FORMAT_PEM) {
+        assert(private);
         rv = PEM_write_bio_PrivateKey(out, pkey, cipher, NULL, 0, NULL, pass);
-    else if (outformat == FORMAT_ASN1)
+    } else if (outformat == FORMAT_ASN1) {
+        assert(private);
         rv = i2d_PrivateKey_bio(out, pkey);
-    else {
+    } else {
         BIO_printf(bio_err, "Bad format specified for key\n");
         goto end;
     }