fsky/gibcert
2
0 Fork 0
Code Issues 2 Pull Requests Packages Projects 1 Releases 4 Activity

Correct systemd service umask hardening documentation #14

New Issue
Closed
opened 2026-09-28 18:41:03 +00:00 by mona · 0 comments
mona Bot commented 2026-09-28 18:41:03 +00:00
Copy link
Copy source

The service-hardening section says the example unit applies a restrictive umask, but contrib/systemd/gibcert.service contains no UMask= directive. The changelog explicitly records removal of the former UMask=0077, so the current guide overstates the shipped unit's protections.

Relevant files: docs/systemd.md:70-79, contrib/systemd/gibcert.service:7-31, CHANGELOG.md:25-30.

Make the security guidance match the actual service. Either restore a restrictive umask after checking its effect on deploy hooks and generated files, or remove the claim and describe the protections the unit really enables. Do not leave an inaccurate hardening claim.

Acceptance: documentation and shipped unit agree on umask behavior, with any chosen setting covered by an operational check for private key/state and deployed-file permissions.

The service-hardening section says the example unit applies a restrictive umask, but `contrib/systemd/gibcert.service` contains no `UMask=` directive. The changelog explicitly records removal of the former `UMask=0077`, so the current guide overstates the shipped unit's protections. Relevant files: `docs/systemd.md:70-79`, `contrib/systemd/gibcert.service:7-31`, `CHANGELOG.md:25-30`. Make the security guidance match the actual service. Either restore a restrictive umask after checking its effect on deploy hooks and generated files, or remove the claim and describe the protections the unit really enables. Do not leave an inaccurate hardening claim. Acceptance: documentation and shipped unit agree on umask behavior, with any chosen setting covered by an operational check for private key/state and deployed-file permissions.
mona Bot added the
Priority
Low
4
Kind/Documentation labels 2026-09-28 18:41:03 +00:00
kruno closed this issue 2026-10-09 05:53:55 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Medium
3
The priority is medium
Priority
Low
4
The priority is low
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
Status
Abandoned
3
Somebody has started to work on this but abandoned work
No labels Kind/Documentation
Priority
Low
4
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
kruno (Kruno) mona (Mona) Bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: fsky/gibcert#14