From nobody Wed Jul 29 19:42:26 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h9N5Z31tHz6mkf9 for ; Wed, 29 Jul 2026 19:42:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h9N5Z1ZPzz3Xmf for ; Wed, 29 Jul 2026 19:42:26 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785354146; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=oTcO+/WJAFeLeGhpnp+6uPovUR5r2i3s+1Itocb5Sco=; b=a3+9mVA/pfTSZ0bOUsLSREL1SMCKNciMtE2G6AW8XgI2/TMITYpM8aee08qiTk4WJC6RWF Dn84FBbkIwPNVNDnEx6dFbvPL/1D5KSnQ+FYtzSDz7FUW/loBeDhtpoD00pqjmqWTnbiHE Xj6pBqq9bd5PU0XOU7pUEf6WHGRYyS4S4T5f3sOToeOeVlVjEaqjJWcV0SbCeWPBi7nSY8 XkOW+uU8j6kjQbLa80BB5tEqCDjJcyQDhiuN7nvJ9xxpmKJ3zBH0a/nb4zIwv1NC9kJRS7 GE/fIZa5L/oByVELg7h7P+lTLzJotD9XNJAUbfJC5Q8jGllHlBIIXoz/xc4oAg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785354146; a=rsa-sha256; cv=none; b=KeuuR/VBdrYwen1cRb5OiP2jS9VobLWq4dvWfPnzxOYVrOa5NlTvCqCFa0MWtd278sWdn1 yQb5B1VPml5gm1J/A0u0Swwyiu3TxLcMlQZZex5z5cmwDEH4tp81o+Wf2S+rz76yZ95Pp3 oKSGx9Uhu/otRCOYHpIbBj1kpqztTVv56cKvj7xlpJUh7FCfQsNIscCeJ/OF82ncbu1G8I jJ6WCLsQohhb2iSzXlGCEifM6EXoWKWTZoXGW6/Jk1dDm/yL6Q/Yzm1dedNJgzqdJXfO5E aWITHYSJ/jWCSdl+ndu092JK9WDjcpmoQQldfOEYo4+9MA3UtVjW9D1RbO0OcA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785354146; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=oTcO+/WJAFeLeGhpnp+6uPovUR5r2i3s+1Itocb5Sco=; b=xzyyUxWeQARg5CnJJU9gBbrjDayvNKNt4QpPUpkau5BgqEI75To0wFZbwgLN8Qx4L0xx1X I8XHDFevuGhnrLp7JD2M79dL8v089Z89diHJWJmvl1vAmo6OuGas6lWWtPz+jQxoUMBw8r c9cwV6WXPyg/u7X6MOYikFT1xkCBs6dDE5fS0jveI1q15lGAu/cSj4XGq2OGpSO4PYhdPy mDahTP4kgIOVF1HGDooLYcSm5Tfy3uoaLovH3jmuizYCvOnZe2ClQ86KWL+q2SWMrDQdyr eLtNCVphuhjA1vUngGwfyNqywN75zxAj8VNM2dXl8CpdykoboXTaOw0TEqLj5A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h9N5Z0b3CzhKq for ; Wed, 29 Jul 2026 19:42:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 47507 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 29 Jul 2026 19:42:26 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Lexi Winter Subject: git: 23216f6309c6 - stable/15 - certctl: Enforce 0444 mode on new files List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ivy X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 23216f6309c6368324fa7aefa8385a7b63b0be3b Auto-Submitted: auto-generated Date: Wed, 29 Jul 2026 19:42:26 +0000 Message-Id: <6a6a57a2.47507.7df3542@gitrepo.freebsd.org> The branch stable/15 has been updated by ivy: URL: https://cgit.FreeBSD.org/src/commit/?id=23216f6309c6368324fa7aefa8385a7b63b0be3b commit 23216f6309c6368324fa7aefa8385a7b63b0be3b Author: Lexi Winter AuthorDate: 2026-07-19 12:45:43 +0000 Commit: Lexi Winter CommitDate: 2026-07-29 19:42:12 +0000 certctl: Enforce 0444 mode on new files When writing to a file, call fchmod() to ensure the file mode matches the intended mode, which is 0444. This was already done when replacing an existing file, but not when creating a new file, which meant if the process umask was 077, the resulting certificates and bundle would be unreadable by unprivileged users. MFC after: 1 week Reviewed by: des Differential Revision: https://reviews.freebsd.org/D58304 (cherry picked from commit 02f174179a538f89185d275b4e64277baf3acc50) --- usr.sbin/certctl/certctl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/usr.sbin/certctl/certctl.c b/usr.sbin/certctl/certctl.c index 98c12dbcaa3c..f14606af0b88 100644 --- a/usr.sbin/certctl/certctl.c +++ b/usr.sbin/certctl/certctl.c @@ -523,6 +523,8 @@ write_certs(const char *dir, struct cert_tree *tree) tmppath = xasprintf(".%s", path); fd = openat(d, tmppath, O_CREAT | O_WRONLY | O_EXCL, mode); + if (!unprivileged && fd >= 0) + (void)fchmod(fd, mode); } } /* write the certificate */ @@ -594,6 +596,8 @@ write_bundle(const char *dir, const char *file, struct cert_tree *tree) } else { tmpfile = xasprintf(".%s", file); fd = openat(d, tmpfile, O_WRONLY | O_CREAT | O_EXCL, mode); + if (!unprivileged && fd >= 0) + (void)fchmod(fd, mode); } if (fd < 0 || (f = fdopen(fd, "w")) == NULL) { if (tmpfile != NULL && fd >= 0) {