From 0bae857564e5189bed600f0a243d96b81b5dcb09 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 11 Sep 2019 18:09:55 +0900 Subject: [PATCH] network: also check the permission of key file --- src/network/netdev/macsec.c | 2 ++ src/network/netdev/wireguard.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/src/network/netdev/macsec.c b/src/network/netdev/macsec.c index cf281e7..d1d65a6 100644 --- a/src/network/netdev/macsec.c +++ b/src/network/netdev/macsec.c @@ -981,6 +981,8 @@ static int macsec_read_key_file(NetDev *netdev, SecurityAssociation *sa) { if (!sa->key_file) return 0; + (void) warn_file_is_world_accessible(sa->key_file, NULL, NULL, 0); + r = read_full_file_full(sa->key_file, READ_FULL_FILE_SECURE | READ_FULL_FILE_UNHEX, (char **) &key, &key_len); if (r < 0) return log_netdev_error_errno(netdev, r, diff --git a/src/network/netdev/wireguard.c b/src/network/netdev/wireguard.c index 913ee2a..a40b32d 100644 --- a/src/network/netdev/wireguard.c +++ b/src/network/netdev/wireguard.c @@ -901,6 +901,8 @@ static int wireguard_read_key_file(const char *filename, uint8_t dest[static WG_ assert(dest); + (void) warn_file_is_world_accessible(filename, NULL, NULL, 0); + r = read_full_file_full(filename, READ_FULL_FILE_SECURE | READ_FULL_FILE_UNBASE64, &key, &key_len); if (r < 0) return r; -- 2.7.4