mkcert.sh: Use umask to create key file as 0600

Fixes a race condition between creation of the file and a later chmod.
This script was mostly meant as an example though, and not really for
production use. Especially because it generates self-signed certs.
CVE-2016-4983

diff --git a/doc/mkcert.sh b/doc/mkcert.sh
index 2fedd481bd3d6f9623d3144e949f7b7eb020332a..f7e484cf4d4e7710f5a0fbfee20810ada8cf45f5 100644 (file)
--- a/doc/mkcert.sh
+++ b/doc/mkcert.sh
@@ -3,6 +3,7 @@
 # Generates a self-signed certificate.
 # Edit dovecot-openssl.cnf before running this.
 
+umask 077
 OPENSSL=${OPENSSL-openssl}
 SSLDIR=${SSLDIR-/etc/ssl}
 OPENSSLCONFIG=${OPENSSLCONFIG-dovecot-openssl.cnf}