Allow stricter permissions but not looser; change default permissions…

… to 0400
square · Jan 14, 2022 · b07315c · b07315c
1 parent fda01db
commit b07315c
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/depot/depot.go b/depot/depot.go
@@ -113,8 +113,8 @@ func (d *FileDepot) check(tag *Tag) error {
 	if err != nil {
 		return err
 	}
-	if ^fi.Mode()&tag.perm != 0 {
-		return errors.New("permission denied")
+	if fi.Mode()&^tag.perm != 0 {
+		return errors.New("unprotected key file `" + tag.name + "': file permissions too open")
 	}
 	return nil
 }

diff --git a/depot/pkix.go b/depot/pkix.go
@@ -31,8 +31,8 @@ const (
 )
 
 const (
-	BranchPerm = 0440
-	LeafPerm   = 0444
+	BranchPerm = 0400
+	LeafPerm   = 0400
 )
 
 // CrtTag returns a tag corresponding to a certificate