populateconfig: setgid /etc/natinst/share/certstore/server_certs - #1074
Open
rtollert wants to merge 1 commit into
Open
populateconfig: setgid /etc/natinst/share/certstore/server_certs#1074rtollert wants to merge 1 commit into
rtollert wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the certstore initialization script to ensure /etc/natinst/share/certstore/server_certs has the correct group/permission behavior so files created by privileged utilities remain readable by the webserver via the niwscerts group.
Changes:
- Adjusts permissions on
server_certsto attempt to enforce group inheritance/readability.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Certain utilities run as the superuser may manipulate keys/certificates in /etc/natinst/share/certstore/server_certs, whose contents must be readable by the webserver (user webserv). To ensure that files created by the superuser are readable here, mark the directory setgid, so that group niwscerts (of which webserv is a member) can read them.
rtollert
force-pushed
the
dev/rtollert/scarthgap/setgid-certs
branch
from
August 31, 2026 20:09
fe052b1 to
3c48134
Compare
Contributor
|
@rtollert The commit is missing your sign-off tag. Also more of a nitpick but since you have to edit the commit message for the sign-off can you use the 50/72 commit formatting rule. Looks good otherwise. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Certain utilities run as the superuser may manipulate keys/certificates in /etc/natinst/share/certstore/server_certs, whose contents must be readable by the webserver (user webserv). To ensure that files created by the superuser are readable here, mark the directory setgid, so that group niwscerts (of which webserv is a member) can read them.
bitbake packagefeed-ni-core)