diff options
| author | Craig Jennings <c@cjennings.net> | 2026-05-06 22:50:37 -0500 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-05-06 22:50:37 -0500 |
| commit | 565cb80d10a0a382d320cec18582e92a09c0e214 (patch) | |
| tree | ec0a1e20d94492c90da502322367054e978a2d5d /assets/2026-02-01-gcalcli-setup.org | |
| parent | 6163a0c08af167f7f4febed1f7d2d07cf032c1a9 (diff) | |
| download | archsetup-565cb80d10a0a382d320cec18582e92a09c0e214.tar.gz archsetup-565cb80d10a0a382d320cec18582e92a09c0e214.zip | |
fix(archsetup): tighten /efi mount permissions in fstab
archinstall writes the /efi line to /etc/fstab with `defaults` (or similar) and no fmask/dmask, so files inside end up 0755. Kernel images, initramfs, and bootloader config are world-readable on a freshly installed system. On a single-user machine that's mild, but there's no good reason to leave it that way.
I added a guarded sed to boot_ux() that appends `fmask=0177,dmask=0077` to the /efi vfat line. Files end up 0600 and dirs 0700, root-only. The block is idempotent. Both guards check that the /efi line exists and that fmask= isn't already there before touching anything. I patched this machine's fstab the same way, so the new options take effect on next boot.
Diffstat (limited to 'assets/2026-02-01-gcalcli-setup.org')
0 files changed, 0 insertions, 0 deletions