From: Timo Sirainen <timo.sirainen@dovecot.fi>
Date: Mon, 21 Nov 2016 23:28:33 +0000 (+0200)
Subject: mkcert.sh: Use umask to create key file as 0600
X-Git-Tag: 2.3.0.rc1~2510
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e8e00a579e12dcb57b0c4077fed2df3f4106ae5a;p=thirdparty%2Fdovecot%2Fcore.git

mkcert.sh: Use umask to create key file as 0600

Fixes a race condition between creation of the file and a later chmod.
This script was mostly meant as an example though, and not really for
production use. Especially because it generates self-signed certs.
CVE-2016-4983
---

diff --git a/doc/mkcert.sh b/doc/mkcert.sh
index 2fedd481bd..f7e484cf4d 100644
--- a/doc/mkcert.sh
+++ b/doc/mkcert.sh
@@ -3,6 +3,7 @@
 # Generates a self-signed certificate.
 # Edit dovecot-openssl.cnf before running this.
 
+umask 077
 OPENSSL=${OPENSSL-openssl}
 SSLDIR=${SSLDIR-/etc/ssl}
 OPENSSLCONFIG=${OPENSSLCONFIG-dovecot-openssl.cnf}