Merge pull request #121294 from nh2/issue-121288-wireguard-fix-chmod-race

wireguard module: generatePrivateKeyFile: Fix chmod security race
2021-05-03 16:24:42 +02:00
parent 1d76dfb811 a874a8a98b
commit 3e930b7e4a
2 changed files with 19 additions and 5 deletions
@@ -333,6 +333,17 @@
      <literal>vim</literal> and <literal>neovim</literal> switched to Python 3, dropping all Python 2 support.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     <link linkend="opt-networking.wireguard.interfaces">networking.wireguard.interfaces.&lt;name&gt;.generatePrivateKeyFile</link>,
+     which is off by default, had a <literal>chmod</literal> race condition
+     fixed. As an aside, the parent directory's permissions were widened,
+     and the key files were made owner-writable.
+     This only affects newly created keys.
+     However, if the exact permissions are important for your setup, read
+     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/121294">#121294</link>.
+    </para>
+   </listitem>
   <listitem>
     <para>
      <link linkend="opt-boot.zfs.forceImportAll">boot.zfs.forceImportAll</link>