private keys shouldn't be world-readable about sbctl HOT 8 CLOSED

Oh, and by the way, thanks a lot for this great tool - finally a workable secure boot management tool :)

from sbctl.

Yolo, copy-pasted code. Thanks :)

from sbctl.

Interesting, my keys are 600... I wonder when the regression happened.

from sbctl.

Interesting, my keys are 600... I wonder when the regression happened.

I just traversed backwards through git blame and the permissions in SaveKey were 0644 since the initial commit.

But here the initial creation of the files was removed from CreateKey (which set 0600) and relied now on the erroneous permissions in SaveKey.

from sbctl.

Maybe the code should even check for too permissive file permissions and refuse signing in this case. Like OpenSSH enforces it for private keys.

from sbctl.

I think that's reasonable, but please with better error messages :p

from sbctl.

We can just do an var ErrInvalidPrivKeyPerms = errors.new("...something") and match it in main.go to give something human readable error back.

https://github.com/Foxboron/sbctl/blob/master/cmd/sbctl/main.go#L69-L78

from sbctl.

Fixed with ea325ca

from sbctl.