From a9d3ad0d8b824e687dc13addc63bbdabcb7dec09 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <[email protected]>
Date: Sat, 2 Jan 2016 23:05:51 -0800
Subject: [PATCH] bug 15574928

Bug 15574928 - SUNBT6859039

Upstream applicability & status unknown.
---
 driver/prefs.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/driver/prefs.c b/driver/prefs.c
index 20f3a4a..c14d1be 100644
--- a/driver/prefs.c
+++ b/driver/prefs.c
@@ -381,7 +381,21 @@ parse_init_file (saver_preferences *p)
       return 0;
     }
 
+  /*
+   * 6859039: unprivileged local users can use xscreensaver to show
+   * contents of files they don't have permission to read.
+   */
+
+  /* Drop Privilege before opening .xscreensaver file */
+  uid_t idorg = geteuid ();
+  if (seteuid (getuid ()) != 0)
+    return 0;
+
   in = fopen(name, "r");
+
+  /* Restore Privilege */
+  seteuid (idorg);
+
   if (!in)
     {
       char *buf = (char *) malloc(1024 + strlen(name));
-- 
2.6.1