From 7010768877c227c9410a06908e4cb3e54db403bd Mon Sep 17 00:00:00 2001 From: James O'Doherty Date: Sun, 7 Jun 2026 21:51:48 -0400 Subject: security: restrict permissions of imported WireGuard profiles to 0600 WireGuard profile files contain sensitive private keys. Previously, these files were written with 0644 permissions, making them world-readable. This commit changes the file mode to 0600 to ensure only the owner can read and write the profiles. - Updated `handleProfileImport` to use 0600 permissions. - Added tests to verify that imported profiles have the correct permissions. --- internal/cli/cli.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'internal/cli/cli.go') diff --git a/internal/cli/cli.go b/internal/cli/cli.go index a4b9a9a..d100d4f 100644 --- a/internal/cli/cli.go +++ b/internal/cli/cli.go @@ -324,7 +324,7 @@ func (a *App) handleProfileImport(srcPath string, name string) error { return fmt.Errorf("failed to read source file: %w", err) } - if err := os.WriteFile(destPath, data, 0644); err != nil { + if err := os.WriteFile(destPath, data, 0600); err != nil { return fmt.Errorf("failed to write profile to %s: %w", destPath, err) } -- cgit v1.2.3