Skip to content

Commit

Permalink
Do not allow any user to read the generated SSL key/crt
Browse files Browse the repository at this point in the history
We need to maintain the feature of being able to run the container as
any user ID, so we cannot just leave the user to have read permissions
for the generated key and certificate.

However, there seems to be no use case for having the permissions
for reading for other users. While being a different user inside a container
might be not relevant anyway in the container case, let's rather be
super cautious and remove the read permissions that are not needed.
  • Loading branch information
hhorak committed Dec 15, 2023
1 parent 9276296 commit ba887da
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions 2.4/root/usr/share/container-scripts/httpd/common.sh
Original file line number Diff line number Diff line change
Expand Up @@ -57,8 +57,8 @@ root@${fqdn}
EOF
fi

chmod 644 ${sslcert}
chmod 644 ${sslkey}
chmod 640 ${sslcert}
chmod 640 ${sslkey}
}

config_general() {
Expand Down

0 comments on commit ba887da

Please sign in to comment.