From e70981d80f3f9d4c42a5bbb74651ae2ed489e6da Mon Sep 17 00:00:00 2001 From: MichaIng Date: Mon, 24 Feb 2025 17:01:17 +0100 Subject: [PATCH] Do not overwrite TLS cert/key mode FTL correctly creates the cert and especially private key with 0600 mode. But the prestart scripts changes it to 0660. After removing the dedicated webserver from Pi-hole setups, the pihole group has no purpose anymore, and files should not be writable to any other user than pihole itself, and the private TLS key not reasable to anyone else either. Additionally, this commit consolidates the chmod calls, applying 0755 to all directories and 0640 to all files, but the TLS key and cert. Signed-off-by: MichaIng --- advanced/Templates/pihole-FTL-prestart.sh | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) mode change 100755 => 100644 advanced/Templates/pihole-FTL-prestart.sh diff --git a/advanced/Templates/pihole-FTL-prestart.sh b/advanced/Templates/pihole-FTL-prestart.sh old mode 100755 new mode 100644 index f0bbe09a..ab449dfe --- a/advanced/Templates/pihole-FTL-prestart.sh +++ b/advanced/Templates/pihole-FTL-prestart.sh @@ -10,22 +10,14 @@ utilsfile="${PI_HOLE_SCRIPT_DIR}/utils.sh" FTL_PID_FILE="$(getFTLConfigValue files.pid)" # Ensure that permissions are set so that pihole-FTL can edit all necessary files -# shellcheck disable=SC2174 -mkdir -pm 0640 /var/log/pihole +mkdir -p /var/log/pihole chown -R pihole:pihole /etc/pihole /var/log/pihole -chmod -R 0640 /var/log/pihole -chmod -R 0660 /etc/pihole +find /etc/pihole /var/log/pihole -type d -exec chmod 0755 {} + +find /etc/pihole /var/log/pihole -type f ! \( -name '*.pem' -o -name '*.crt' \) -exec chmod 0640 {} + +find /etc/pihole /var/log/pihole -type f -name '*.pem' -o -name '*.crt' -exec chmod 0600 {} + -# Logrotate config file need to be owned by root and must not be writable by group and others +# Logrotate config file need to be owned by root chown root:root /etc/pihole/logrotate -chmod 0644 /etc/pihole/logrotate - -# allow all users to enter the directories -chmod 0755 /etc/pihole /var/log/pihole - -# allow pihole to access subdirs in /etc/pihole (sets execution bit on dirs) -# credits https://stackoverflow.com/a/11512211 -find /etc/pihole/ -type d -exec chmod 0755 {} \; # Touch files to ensure they exist (create if non-existing, preserve if existing) [ -f "${FTL_PID_FILE}" ] || install -D -m 644 -o pihole -g pihole /dev/null "${FTL_PID_FILE}"