diff options
| author | Craig Jennings <c@cjennings.net> | 2026-07-08 13:09:54 -0500 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-07-08 13:09:54 -0500 |
| commit | 63f73e06d5ce1475c671ba69817f5f1404691188 (patch) | |
| tree | 5ceb91564441a69e8ccfbfbe62e630a6a9c59528 /configs/maintenance-thresholds.toml | |
| parent | 8d6233d71feedd81e42007575f876b3e4d1c10c4 (diff) | |
| download | archsetup-63f73e06d5ce1475c671ba69817f5f1404691188.tar.gz archsetup-63f73e06d5ce1475c671ba69817f5f1404691188.zip | |
fix(maint): uncurate /etc/ssl/private — it was a real misconfig
pacman warned filesystem 755 vs package 700 on both hosts: a world-listable private-key directory, not runtime hardening as the previous commit claimed. pacman never resets existing directory permissions, so I chmod'd 700 on ratio and velox and removed the curation entry. Integrity reads an honest zero on both.
Diffstat (limited to 'configs/maintenance-thresholds.toml')
| -rw-r--r-- | configs/maintenance-thresholds.toml | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/configs/maintenance-thresholds.toml b/configs/maintenance-thresholds.toml index b522f88..c14eaec 100644 --- a/configs/maintenance-thresholds.toml +++ b/configs/maintenance-thresholds.toml @@ -180,7 +180,9 @@ entries = [ "/etc/cups/subscriptions.conf", "/var/lib/passim*", # StateDirectory re-chowns "/var/log/journal", # tmpfiles re-groups - "/etc/ssl/private", # hardened below packaged mode + # /etc/ssl/private deliberately NOT here: both hosts had it world-listable + # (755 vs packaged 700) — a real misconfig the metric caught. pacman warns + # but never resets existing dir perms; fixed by chmod 2026-07-08. "/usr/lib/utempter/utempter", # setgid-helper ownership; # NOTE: also silences a # content change on this |