certctl: Enforce 0444 mode on new files

When writing to a file, call fchmod() to ensure the file mode matches
the intended mode, which is 0444.  This was already done when replacing
an existing file, but not when creating a new file, which meant if the
process umask was 077, the resulting certificates and bundle would be
unreadable by unprivileged users.

MFC after:	1 week
Reviewed by:	des
Differential Revision:	https://reviews.freebsd.org/D58304

1 files changed, 4 insertions, 0 deletions

diff --git a/usr.sbin/certctl/certctl.c b/usr.sbin/certctl/certctl.c
index 462f6c1730a9..5c2b83b89d57 100644
--- a/usr.sbin/certctl/certctl.c
+++ b/usr.sbin/certctl/certctl.c
@@ -523,6 +523,8 @@ write_certs(const char *dir, struct cert_tree *tree)
 				tmppath = xasprintf(".%s", path);
 				fd = openat(d, tmppath,
 				    O_CREAT | O_WRONLY | O_EXCL, mode);
+				if (!unprivileged && fd >= 0)
+					(void)fchmod(fd, mode);
 			}
 		}
 		/* write the certificate */
@@ -594,6 +596,8 @@ write_bundle(const char *dir, const char *file, struct cert_tree *tree)
 	} else {
 		tmpfile = xasprintf(".%s", file);
 		fd = openat(d, tmpfile, O_WRONLY | O_CREAT | O_EXCL, mode);
+		if (!unprivileged && fd >= 0)
+			(void)fchmod(fd, mode);
 	}
 	if (fd < 0 || (f = fdopen(fd, "w")) == NULL) {
 		if (tmpfile != NULL && fd >= 0) {