The uutils implementation of 'sort' creates temporary files with
insecure permissions when performing external sorting:

```
$ seq 100000000 > input
$ strace -e trace='/mkdir|open' uu_sort --parallel 1 -S 1M input
mkdir("/tmp/uutils_sortDVa4rK", 0777)   = 0
openat(AT_FDCWD, "/proc/self/fd", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
openat(AT_FDCWD, "/tmp/uutils_sortDVa4rK/0", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 4
openat(AT_FDCWD, "/tmp/uutils_sortDVa4rK/1", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 4
openat(AT_FDCWD, "/tmp/uutils_sortDVa4rK/2", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 4
openat(AT_FDCWD, "/tmp/uutils_sortDVa4rK/3", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 4
openat(AT_FDCWD, "/tmp/uutils_sortDVa4rK/4", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 4
openat(AT_FDCWD, "/tmp/uutils_sortDVa4rK/5", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 4
openat(AT_FDCWD, "/tmp/uutils_sortDVa4rK/6", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 4
[...]
```

It also only handles a subset of signals that would terminate a program.
This means that in many cases temporary files will not be removed. For
example, if the 'uu_sort' program receives an SIGFPE signal the
temporary files will remain on the file system:

```
$ umask
0022
$ install -m 600 /dev/null secret-file
$ seq 100000000 >> secret-file
$ ls -ld secret-file
-rw-------. 1 collin collin 888888898 Apr 12 09:36 secret-file
$ ls -ld /tmp/uutils_sort*
ls: cannot access '/tmp/uutils_sort*': No such file or directory
$ timeout -s SIGFPE 1 uu_sort --parallel 1 -S 1M secret-file
timeout: the monitored command dumped core
$ ls -lAd /tmp/uutils_sort*
drwxr-xr-x. 2 collin collin 380 Apr 12 09:36 /tmp/uutils_sortlRyeiH
$ ls -lA --sort=time --reverse /tmp/uutils_sort* | head -n 10
/tmp/uutils_sortlRyeiH:
total 17544
-rw-r--r--. 1 collin collin 1056768 Apr 12 09:36 0
-rw-r--r--. 1 collin collin 1056762 Apr 12 09:36 1
-rw-r--r--. 1 collin collin 1056762 Apr 12 09:36 2
-rw-r--r--. 1 collin collin 1056762 Apr 12 09:36 3
-rw-r--r--. 1 collin collin 1056762 Apr 12 09:36 4
-rw-r--r--. 1 collin collin 1056762 Apr 12 09:36 5
-rw-r--r--. 1 collin collin 1056766 Apr 12 09:36 6
-rw-r--r--. 1 collin collin 1056768 Apr 12 09:36 7
```

Note that in the above example the temporary directory and files are
readable by all users on the system despite the original file only being
accessible by the owner. The files are created with a mode of 0666, so
without being protected by my umask they would be writable to all users.
I assume a sysctl that Fedora uses by default protects the user in this
case:

```
$ (ulimit 0; uu_sort --parallel 1 -S 1M secret-file)
File size limit exceeded   (core dumped) ( ulimit 0; uu_sort --parallel 1 -S 1M secret-file )
```

But I don't think one should rely on that behavior. If those
configurations did not protect me there, then other users would be able
to control the output of the 'uu_sort' command. For example, with the
following command running in one terminal:

```
$ while true; do echo hello | tee /tmp/uutils_sort*/*; done
```

The output of 'uu_sort' in our other terminal is modified:

```
$ install -m 600 /dev/null secret-file
$ seq 100000000 >> secret-file
$ uu_sort --parallel 1 -S 1M secret-file | uniq -c
    416 hello
```

A user could also use this to exhaust disk space, as has already
happened to some users [1].

I discussed this issue with Pádraig Brady and we believe a CVE should be
assigned for it. The examples I gave are fairly trivial, but someone
with malicious intent and more time on their hands could certainly think
of ways to abuse this behavior.

[1] https://github.com/uutils/coreutils/issues/11728

Reproducible: Always

Steps to Reproduce:
Posted in Details.
Actual Results:
uu_sort creates a temporary directory with a mode of 0777 and creates files inside of it with a mode of 0666. It does not clean them up after receiving some signals.

Expected Results:
uu_sort should create files with a mode of 0600 and properly handle all signals.

Additional Information:
$ uu_sort --version
uu_sort (uutils coreutils) 0.7.0