From aceb2bfaf22d64d3c9310d3858c79caa04de05e1 Mon Sep 17 00:00:00 2001 From: Ferdinor Date: Thu, 16 Jul 2026 16:25:04 +0200 Subject: [PATCH] fix: Restrict access to imported key material Without this change imported key-material is copied as-is, which could be extremely permissive. Since we know we are handling confidential key-material, let's restrict the access to the imported files. --- cmd/sbctl/import-keys.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/cmd/sbctl/import-keys.go b/cmd/sbctl/import-keys.go index 65db790b..c077a3a0 100644 --- a/cmd/sbctl/import-keys.go +++ b/cmd/sbctl/import-keys.go @@ -39,7 +39,7 @@ var ( func Import(vfs afero.Fs, src, dst string) error { logging.Print("Importing %s...", src) - if err := os.MkdirAll(filepath.Dir(dst), 0777); err != nil { + if err := os.MkdirAll(filepath.Dir(dst), os.ModePerm); err != nil { logging.NotOk("") return fmt.Errorf("could not create directory for %q: %w", dst, err) } @@ -47,6 +47,10 @@ func Import(vfs afero.Fs, src, dst string) error { logging.NotOk("") return fmt.Errorf("could not move %s: %w", src, err) } + if err := vfs.Chmod(dst, 0o400); err != nil { + logging.NotOk("") + return fmt.Errorf("could not set file permissions %s: %w", dst, err) + } logging.Ok("") return nil }