Security of ODBC debug log file leaves something to be desired

What psqlodbc versions RedHat uses?

At least there are three Enterprise versions:
- Red Hat ES 2
- Red Hat ES 3
- Red Hat ES 4

I know, that ES 2 and ES 3 use different psqlodbc versions.
I don't know about ES 4.
Which ODBC revisions they are in psqlodbc PostgreSQL CVS?
Each of them might need a different fix.

I don't know, wether I can fix those versions myself.
Here is an attached bugfix for the CVS HEAD.

---------------------------------------

I wrote and attached a fix for the following things
for the CVS HEAD branch (see the attached patch):
1. File permissions; chmod go-rwx for the log file: fixed in this patch.
SVr4, SVID, POSIX, X/OPEN, BSD 4.3 for umask()

2. Pipe redirection problem: fixed in this patch.
SVr4, SVID, POSIX, X/OPEN, BSD 4.3 for fd=open()
IEEE Std1003.1-1988 (POSIX.1) for fdopen().

These are not touched in the patch:
3. Log files are easy to guess: not fixed, because the whole idea of
logging is easy guessability.
Maybe the log directory could be changed?
4. Plaintext passwords are not accepted in log files: CVS HEAD is
already OK.

These fixes work with Debian Sarge, compiled by myself.
I do know, that these fixes do not compile directly with Windows XP:
XP needs at least #include <io.h> and open -> _open and fdopen -> _fdopen
and so forth.
I hope, that they compile with many architectures because of the POSIX
compatibility.

I fixed the pipe redirection problem by forcing the creation of the log
file.
If the log file exists already, no logging is done.
It prints an error message into stderr (only once).
So it can't be a pipe or a soft link! This problem remains with NFS:
open() with O_EXCL does not work properly with NFS (see man 2 open).

Marko Ristola