From 2cac6b11a638afdfa1b50b7144a4439c56c91cdb Mon Sep 17 00:00:00 2001 From: Jonathon Anderson Date: Tue, 17 Feb 2026 14:22:33 -0700 Subject: [PATCH] Explicitly set permissions on import TLS keys and certificates Signed-off-by: Jonathon Anderson --- internal/app/wwctl/configure/tls/main.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/internal/app/wwctl/configure/tls/main.go b/internal/app/wwctl/configure/tls/main.go index bffc4147..b84fe8a7 100644 --- a/internal/app/wwctl/configure/tls/main.go +++ b/internal/app/wwctl/configure/tls/main.go @@ -43,9 +43,15 @@ func CobraRunE(cmd *cobra.Command, args []string) error { if err := util.CopyFile(sourceKey, keyFile); err != nil { return fmt.Errorf("failed to import key: %w", err) } + if err := os.Chmod(keyFile, 0600); err != nil { + return fmt.Errorf("failed to set key file permissions: %w", err) + } if err := util.CopyFile(sourceCert, certFile); err != nil { return fmt.Errorf("failed to import cert: %w", err) } + if err := os.Chmod(certFile, 0644); err != nil { + return fmt.Errorf("failed to set cert file permissions: %w", err) + } fmt.Fprintf(cmd.OutOrStdout(), "Imported keys from %s\n", importPath) if err := configure.WAREWULFD(); err != nil {