Page MenuHomeFreeBSD

certctl: Enforce 0444 mode on new files
ClosedPublic

Authored by ivy on Fri, Jul 17, 3:21 PM.
Tags
None
Referenced Files
F163462662: D58304.diff
Thu, Jul 23, 9:43 AM
F163448472: D58304.id182135.diff
Thu, Jul 23, 7:15 AM
Unknown Object (File)
Wed, Jul 22, 8:00 AM
Unknown Object (File)
Wed, Jul 22, 4:12 AM
Unknown Object (File)
Wed, Jul 22, 3:55 AM
Unknown Object (File)
Wed, Jul 22, 2:47 AM
Unknown Object (File)
Wed, Jul 22, 2:01 AM
Unknown Object (File)
Mon, Jul 20, 4:08 AM
Subscribers

Details

Summary

When writing to a file, call fchmod() to ensure the file mode matches
the intended mode, which is 0444. This was already done when replacing
an existing file, but not when creating a new file, which meant if the
process umask was 077, the resulting certificates and bundle would be
unreadable by unprivileged users.

MFC after: 1 week

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable