diff options
| author | Craig Jennings <c@cjennings.net> | 2026-07-20 12:44:01 -0500 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-07-20 12:44:01 -0500 |
| commit | dffecf528cd20af2bd4437df567896ce03cabe2f (patch) | |
| tree | 8c9ef1c82bc3bad726e33b1b58996bdfdc44c4ea /scripts/testing/tests | |
| parent | 1115543736997cc612d31109cf83391a744051c4 (diff) | |
| download | archsetup-dffecf528cd20af2bd4437df567896ce03cabe2f.tar.gz archsetup-dffecf528cd20af2bd4437df567896ce03cabe2f.zip | |
fix(security): decrypt the cmail password under a tight umask
gpg writes its output at the process umask (often 0644), so the plaintext mail password was world-readable between the decrypt and the chmod. I extracted decrypt_to_secure, which runs the decrypt in a 0077 umask subshell so the file is 0600 from creation. A fake-gpg test pins that the write runs under the tight umask.
Diffstat (limited to 'scripts/testing/tests')
0 files changed, 0 insertions, 0 deletions