nixos/privacyidea-ldap-proxy: umask to avoid accidental world-readability

2022-07-20 20:12:46 +02:00 · 2022-07-20 20:12:46 +02:00 · 81add6600c
parent 39c0694709
commit 81add6600c
1 changed files with 1 additions and 0 deletions
--- a/nixos/modules/services/security/privacyidea.nix
+++ b/nixos/modules/services/security/privacyidea.nix
@ -332,6 +332,7 @@ in
            [ cfg.ldap-proxy.environmentFile ];
          ExecStartPre =
            "${pkgs.writeShellScript "substitute-secrets-ldap-proxy" ''
+              umask 0077
              ${pkgs.envsubst}/bin/envsubst \
                -i ${ldapProxyConfig} \
                -o $STATE_DIRECTORY/ldap-proxy.ini