Changeset

5151:dfe6a70efaa2

prosodyctl: Set stricter umask while generating key (thanks darkrain)
author Kim Alvefur <zash@zash.se>
date Wed, 19 Sep 2012 23:26:38 +0200 (2012-09-19)
parents 5150:81b49bb0ecc7
children 5152:fee5f8d4ec74
files prosodyctl
diffstat 1 files changed, 3 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/prosodyctl	Wed Sep 19 23:25:10 2012 +0200
+++ b/prosodyctl	Wed Sep 19 23:26:38 2012 +0200
@@ -687,11 +687,13 @@
 		if ask_overwrite(key_filename) then
 			return nil, key_filename;
 		end
-		os.remove(key_filename); -- We chmod this file to not have write permissions
+		os.remove(key_filename); -- This file, if it exists is unlikely to have write permissions
 		local key_size = tonumber(arg[2] or show_prompt("Choose key size (2048):") or 2048);
+		local old_umask = pposix.umask("0377");
 		if openssl.genrsa{out=key_filename, key_size} then
 			os.execute(("chmod 400 '%s'"):format(key_filename));
 			show_message("Key written to ".. key_filename);
+			pposix.umask(old_umask);
 			return nil, key_filename;
 		end
 		show_message("There was a problem, see OpenSSL output");