Certificate output directories created with mode 0777 #28

New issue

Open

opened 2026-05-17 23:13:16 +02:00 by heiko · 1 comment

heiko commented

2026-05-17 23:13:16 +02:00

Owner

Summary

internal/shared/mkdir.go:10 creates directories with mode 0777:

err := os.Mkdir(dir, 0777)

A typical umask of 022 reduces this to 0755 (world-readable and world-executable). Certificate subdirectories holding private key files should not be world-accessible.

Impact

Any local user can list the contents of the cert output directories. Combined with a permissive umask, the actual privkey.pem files inside may also be readable if their own permissions are misconfigured.

Fix

Use mode 0700 (or at minimum 0750) for directories that hold certificate material:

err := os.Mkdir(dir, 0700)

## Summary `internal/shared/mkdir.go:10` creates directories with mode `0777`: ```go err := os.Mkdir(dir, 0777) ``` A typical umask of `022` reduces this to `0755` (world-readable and world-executable). Certificate subdirectories holding private key files should not be world-accessible. ## Impact Any local user can list the contents of the cert output directories. Combined with a permissive umask, the actual `privkey.pem` files inside may also be readable if their own permissions are misconfigured. ## Fix Use mode `0700` (or at minimum `0750`) for directories that hold certificate material: ```go err := os.Mkdir(dir, 0700) ```

heiko added the

security

label

2026-05-17 23:13:16 +02:00

heiko referenced this issue

2026-05-22 00:31:18 +02:00

fix: Lstat in Mkdir rejects symlink-to-dir #40

heiko referenced this issue

2026-05-22 00:44:59 +02:00

fix: Lstat in Mkdir rejects symlink-to-dir #40

heiko referenced this issue

2026-05-22 08:30:21 +02:00