Mirrors/yggdrasil-go
1
0
Fork 0
mirror of https://github.com/yggdrasil-network/yggdrasil-go.git synced 2026-05-22 13:56:30 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix default config permissions (#1253)

Browse Source 
Currently, all init scripts, except for systemd, will generate a config
file with default permissions, which is usually `rw-r--r--`.
This is bad, because the config contains a private key.

The systemd service does `chmod 640` after creating the config, which is
much better than just leaving it readable for everyone forever, but
there is still a slight chance that some malicious program might steal
the private key during the time window between key creation and chmod.

For this reason, in this pull request I use `umask 037`, so the config
won't have read permission for others in the first place.

Note that I have only tested openrc and systemd services.

Also, I'm not sure what to do with the contrib/msi/build-msi.sh script,
which creates a bat file that generates a config. I don't know anything
about file permissions on windows, however, it seems that the bat file
generates the config into a user's personal directory, so maybe it's
already somewhat fine.
This commit is contained in:
mirefly42
2026-01-18 21:58:00 +07:00
committed by GitHub
parent fd46eab3b9
commit df48ac2ada
8 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
contrib/freebsd/yggdrasil
View File

@@ -33,7 +33,7 @@ yggdrasil_start()
test ! -f /etc/yggdrasil.conf && (
logger -s -t yggdrasil "Generating new configuration file into /etc/yggdrasil.conf"
/usr/local/bin/yggdrasil -genconf > /etc/yggdrasil.conf
(umask 037 && /usr/local/bin/yggdrasil -genconf > /etc/yggdrasil.conf)
)
tap_path="$(cat /etc/yggdrasil.conf | egrep -o '/dev/tap[0-9]{1,2}$')"