Date: Sun, 19 Jul 2026 12:46:25 +0000 From: Lexi Winter <ivy@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 02f174179a53 - main - certctl: Enforce 0444 mode on new files Message-ID: <6a5cc721.37bee.3c8025e0@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by ivy: URL: https://cgit.FreeBSD.org/src/commit/?id=02f174179a538f89185d275b4e64277baf3acc50 commit 02f174179a538f89185d275b4e64277baf3acc50 Author: Lexi Winter <ivy@FreeBSD.org> AuthorDate: 2026-07-19 12:45:43 +0000 Commit: Lexi Winter <ivy@FreeBSD.org> CommitDate: 2026-07-19 12:45:43 +0000 certctl: Enforce 0444 mode on new files When writing to a file, call fchmod() to ensure the file mode matches the intended mode, which is 0444. This was already done when replacing an existing file, but not when creating a new file, which meant if the process umask was 077, the resulting certificates and bundle would be unreadable by unprivileged users. MFC after: 1 week Reviewed by: des Differential Revision: https://reviews.freebsd.org/D58304 --- usr.sbin/certctl/certctl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/usr.sbin/certctl/certctl.c b/usr.sbin/certctl/certctl.c index 462f6c1730a9..5c2b83b89d57 100644 --- a/usr.sbin/certctl/certctl.c +++ b/usr.sbin/certctl/certctl.c @@ -523,6 +523,8 @@ write_certs(const char *dir, struct cert_tree *tree) tmppath = xasprintf(".%s", path); fd = openat(d, tmppath, O_CREAT | O_WRONLY | O_EXCL, mode); + if (!unprivileged && fd >= 0) + (void)fchmod(fd, mode); } } /* write the certificate */ @@ -594,6 +596,8 @@ write_bundle(const char *dir, const char *file, struct cert_tree *tree) } else { tmpfile = xasprintf(".%s", file); fd = openat(d, tmpfile, O_WRONLY | O_CREAT | O_EXCL, mode); + if (!unprivileged && fd >= 0) + (void)fchmod(fd, mode); } if (fd < 0 || (f = fdopen(fd, "w")) == NULL) { if (tmpfile != NULL && fd >= 0) {home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a5cc721.37bee.3c8025e0>