wg-quick: enforce good permissions

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

diff --git a/src/Makefile b/src/Makefile
index 8160cc9fb72f154eca2b21d918342489d1ad182e..fee7951a280574672b0620d8fc920a8c9170320c 100644 (file)
--- a/src/Makefile
+++ b/src/Makefile
@@ -1,6 +1,7 @@
 PKG_CONFIG ?= pkg-config
 PREFIX ?= /usr
 DESTDIR ?=
+SYSCONFDIR ?= /etc
 BINDIR ?= $(PREFIX)/bin
 LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
@@ -54,7 +55,7 @@ install: wg
        @[ "$(WITH_BASHCOMPLETION)" = "yes" ] || exit 0; \
        install -v -d "$(DESTDIR)$(BASHCOMPDIR)" && install -m 0644 -v completion/wg.bash-completion "$(DESTDIR)$(BASHCOMPDIR)/wg"
        @[ "$(WITH_WGQUICK)" = "yes" ] || exit 0; \
-       install -m 0755 -v wg-quick.bash "$(DESTDIR)$(BINDIR)/wg-quick"
+       install -m 0755 -v wg-quick.bash "$(DESTDIR)$(BINDIR)/wg-quick" && install -m 0700 -v -d "$(DESTDIR)$(SYSCONFDIR)/wireguard"
        @[ "$(WITH_WGQUICK)" = "yes" ] || exit 0; \
        install -m 0644 -v wg-quick.8 "$(DESTDIR)$(MANDIR)/man8/wg-quick.8"
        @[ "$(WITH_WGQUICK)" = "yes" -a "$(WITH_BASHCOMPLETION)" = "yes" ] || exit 0; \

diff --git a/src/wg-quick.bash b/src/wg-quick.bash
index e686d7397ed9e28f26157dcc2f47d8fea501aaff..c9157ad9842a70830406a30f870ebdbf88a1775c 100755 (executable)
--- a/src/wg-quick.bash
+++ b/src/wg-quick.bash
@@ -27,6 +27,7 @@ parse_options() {
        [[ $CONFIG_FILE =~ ^[a-zA-Z0-9_=+.-]{1,16}$ ]] && CONFIG_FILE="/etc/wireguard/$CONFIG_FILE.conf"
        [[ -e $CONFIG_FILE ]] || die "\`$CONFIG_FILE' does not exist"
        [[ $CONFIG_FILE =~ /?([a-zA-Z0-9_=+.-]{1,16})\.conf$ ]] || die "The config file must be a valid interface name, followed by .conf"
+       ((($(stat -c '%#a' "$CONFIG_FILE") & 0007) == 0)) || echo "Warning: \`$CONFIG_FILE' is world accessible" >&2
        INTERFACE="${BASH_REMATCH[1]}"
        shopt -s nocasematch
        while read -r line; do