The branch main has been updated by ivy: URL: https://cgit.FreeBSD.org/src/commit/?id=02f174179a538f89185d275b4e64277baf3acc50
commit 02f174179a538f89185d275b4e64277baf3acc50 Author: Lexi Winter <[email protected]> AuthorDate: 2026-07-19 12:45:43 +0000 Commit: Lexi Winter <[email protected]> CommitDate: 2026-07-19 12:45:43 +0000 certctl: Enforce 0444 mode on new files When writing to a file, call fchmod() to ensure the file mode matches the intended mode, which is 0444. This was already done when replacing an existing file, but not when creating a new file, which meant if the process umask was 077, the resulting certificates and bundle would be unreadable by unprivileged users. MFC after: 1 week Reviewed by: des Differential Revision: https://reviews.freebsd.org/D58304 --- usr.sbin/certctl/certctl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/usr.sbin/certctl/certctl.c b/usr.sbin/certctl/certctl.c index 462f6c1730a9..5c2b83b89d57 100644 --- a/usr.sbin/certctl/certctl.c +++ b/usr.sbin/certctl/certctl.c @@ -523,6 +523,8 @@ write_certs(const char *dir, struct cert_tree *tree) tmppath = xasprintf(".%s", path); fd = openat(d, tmppath, O_CREAT | O_WRONLY | O_EXCL, mode); + if (!unprivileged && fd >= 0) + (void)fchmod(fd, mode); } } /* write the certificate */ @@ -594,6 +596,8 @@ write_bundle(const char *dir, const char *file, struct cert_tree *tree) } else { tmpfile = xasprintf(".%s", file); fd = openat(d, tmpfile, O_WRONLY | O_CREAT | O_EXCL, mode); + if (!unprivileged && fd >= 0) + (void)fchmod(fd, mode); } if (fd < 0 || (f = fdopen(fd, "w")) == NULL) { if (tmpfile != NULL && fd >= 0) {
