diff options
| author | Craig Jennings <c@cjennings.net> | 2026-05-06 22:50:37 -0500 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-05-06 22:50:37 -0500 |
| commit | c1612e7b307ca6463a1b3dba31257ddb5999a3c7 (patch) | |
| tree | ec0a1e20d94492c90da502322367054e978a2d5d /dotfiles/common | |
| parent | 955d02333a75d08ede6c96ac0c1efe5a81077693 (diff) | |
| download | archsetup-c1612e7b307ca6463a1b3dba31257ddb5999a3c7.tar.gz archsetup-c1612e7b307ca6463a1b3dba31257ddb5999a3c7.zip | |
fix(archsetup): tighten /efi mount permissions in fstab
archinstall writes the /efi line to /etc/fstab with `defaults` (or similar) and no fmask/dmask, so files inside end up 0755. Kernel images, initramfs, and bootloader config are world-readable on a freshly installed system. On a single-user machine that's mild, but there's no good reason to leave it that way.
I added a guarded sed to boot_ux() that appends `fmask=0177,dmask=0077` to the /efi vfat line. Files end up 0600 and dirs 0700, root-only. The block is idempotent. Both guards check that the /efi line exists and that fmask= isn't already there before touching anything. I patched this machine's fstab the same way, so the new options take effect on next boot.
Diffstat (limited to 'dotfiles/common')
0 files changed, 0 insertions, 0 deletions