Skip to content

create credential private key files with mode 0600 #197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tanjiroK-coder wants to merge 2 commits into
base: master
Choose a base branch
from
Open

create credential private key files with mode 0600 #197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dc9820b
create credential private key files with mode 0600
tanjiroK-coder Oct 26, 2026
89be684
address review: openssl_open_file with mode, handle .ktm, split test …
tanjiroK-coder Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cups/file.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -642,7 +642,7 @@ cupsFileOpen(const char *filename, // I - Name of file
if ((ptr = strchr(mode, 'm')) != NULL && ptr[1] >= '0' && ptr[1] <= '7')
{
// Get permissions from mode string...
perm = (int)strtol(mode + 1, NULL, 8);
perm = (int)strtol(ptr + 1, NULL, 8);
}

// Open the file...
Expand Down
17 changes: 17 additions & 0 deletions cups/testcreds.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,6 +409,7 @@ do_unit_tests(void)
*chain; // Cert chain data
size_t chainlen; // Length of cert chain data
http_trust_t trust; // Trust in credentials
struct stat fileinfo; // Key file information
static const char * const alt_names[] =
{ // subjectAltName values
"printer.example.com",
Expand Down Expand Up @@ -442,6 +443,14 @@ do_unit_tests(void)
data = cupsCopyCredentialsKey(TEST_CERT_PATH, "_site_");
testEnd(data != NULL);
free(data);

testBegin("_site_.key permissions");
if (stat(TEST_CERT_PATH "/_site_.key", &fileinfo))
testEndMessage(false, "%s", strerror(errno));
else if (fileinfo.st_mode & 077)
testEndMessage(false, "wrong permissions, got %03o expected %03o.", (unsigned)(fileinfo.st_mode & 0777), (unsigned)(fileinfo.st_mode & 0700));
else
testEnd(true);
}
else
{
Expand Down Expand Up @@ -520,6 +529,14 @@ do_unit_tests(void)
testEnd(data != NULL);
free(data);

testBegin("altprinter.ktm permissions");
if (stat(TEST_CERT_PATH "/altprinter.ktm", &fileinfo))
testEndMessage(false, "%s", strerror(errno));
else if (fileinfo.st_mode & 077)
testEndMessage(false, "wrong permissions, got %03o expected %03o.", (unsigned)(fileinfo.st_mode & 0777), (unsigned)(fileinfo.st_mode & 0700));
else
testEnd(true);

testBegin("cupsCopyCredentialsRequest(altprinter w/alt names)");
data = cupsCopyCredentialsRequest(TEST_CERT_PATH, "altprinter");
testEnd(data != NULL);
Expand Down
4 changes: 2 additions & 2 deletions cups/tls-gnutls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,7 +231,7 @@ cupsCreateCredentials(
_cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(err), 0);
goto done;
}
else if ((fp = cupsFileOpen(keyfile, "w")) != NULL)
else if ((fp = cupsFileOpen(keyfile, "wm600")) != NULL)
{
DEBUG_printf("1cupsCreateCredentials: Writing private key to \"%s\".", keyfile);
cupsFileWrite(fp, (char *)buffer, bytes);
Expand Down Expand Up @@ -586,7 +586,7 @@ cupsCreateCredentialsRequest(
DEBUG_printf("1cupsCreateCredentialsRequest: Unable to export private key: %s", gnutls_strerror(err));
goto done;
}
else if ((fp = cupsFileOpen(keyfile, "w")) != NULL)
else if ((fp = cupsFileOpen(keyfile, "wm600")) != NULL)
{
DEBUG_printf("1cupsCreateCredentialsRequest: Writing private key to \"%s\".", keyfile);
cupsFileWrite(fp, (char *)buffer, bytes);
Expand Down
37 changes: 30 additions & 7 deletions cups/tls-openssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ static X509_EXTENSION *openssl_create_san(const char *common_name, size_t num_al
static time_t openssl_get_date(X509 *cert, int which);
//static void openssl_load_crl(void);
static STACK_OF(X509 *) openssl_load_x509(const char *credentials);
static BIO *openssl_open_file(const char *filename, int mode);
static bool openssl_validate_name(X509 *cert, const char *common_name);


Expand Down Expand Up @@ -370,7 +371,7 @@ cupsCreateCredentials(
http_make_path(keyfile, sizeof(keyfile), path, common_name, "key");
http_make_path(pubfile, sizeof(pubfile), path, common_name, "pub");

if ((bio = BIO_new_file(keyfile, "wb")) == NULL)
if ((bio = openssl_open_file(keyfile, 0600)) == NULL)
{
_cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
goto done;
Expand All @@ -385,7 +386,7 @@ cupsCreateCredentials(

BIO_free(bio);

if ((bio = BIO_new_file(pubfile, "wb")) == NULL)
if ((bio = openssl_open_file(pubfile, 0644)) == NULL)
{
_cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
goto done;
Expand All @@ -400,7 +401,7 @@ cupsCreateCredentials(

BIO_free(bio);

if ((bio = BIO_new_file(crtfile, "wb")) == NULL)
if ((bio = openssl_open_file(crtfile, 0644)) == NULL)
{
_cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
goto done;
Expand Down Expand Up @@ -606,7 +607,7 @@ cupsCreateCredentialsRequest(
sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);

// Save them...
if ((bio = BIO_new_file(keyfile, "wb")) == NULL)
if ((bio = openssl_open_file(keyfile, 0600)) == NULL)
{
_cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
goto done;
Expand All @@ -621,7 +622,7 @@ cupsCreateCredentialsRequest(

BIO_free(bio);

if ((bio = BIO_new_file(pubfile, "wb")) == NULL)
if ((bio = openssl_open_file(pubfile, 0644)) == NULL)
{
_cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
goto done;
Expand All @@ -636,7 +637,7 @@ cupsCreateCredentialsRequest(

BIO_free(bio);

if ((bio = BIO_new_file(csrfile, "wb")) == NULL)
if ((bio = openssl_open_file(csrfile, 0644)) == NULL)
{
_cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
goto done;
Expand Down Expand Up @@ -1411,7 +1412,7 @@ cupsSignCredentialsRequest(
// Save the certificate...
http_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");

if ((bio = BIO_new_file(crtfile, "wb")) == NULL)
if ((bio = openssl_open_file(crtfile, 0644)) == NULL)
{
_cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
goto done;
Expand Down Expand Up @@ -2609,6 +2610,28 @@ openssl_load_x509(
}


//
// 'openssl_open_file()' - Create a file for writing with the given permissions.
//

static BIO * // O - File BIO or `NULL` on error
openssl_open_file(const char *filename, // I - Filename
int mode) // I - Permissions
{
int fd; // File descriptor
BIO *bio; // File BIO


if ((fd = open(filename, O_CREAT | O_WRONLY | O_TRUNC, mode)) < 0)
return (NULL);

if ((bio = BIO_new_fd(fd, BIO_CLOSE)) == NULL)
close(fd);

return (bio);
}


//
// 'openssl_validate_name()' - Check that the certificate is valid for the given name.
//
Expand Down
2 changes: 1 addition & 1 deletion cups/tls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -811,7 +811,7 @@ http_save_file(const char *path, // I - Directory path for certificate/key store
return (true);
}

if ((fd = open(filename, O_CREAT | O_WRONLY | O_TRUNC, 0644)) < 0)
if ((fd = open(filename, O_CREAT | O_WRONLY | O_TRUNC, (strcmp(ext, "key") && strcmp(ext, "ktm")) ? 0644 : 0600)) < 0)
return (false);

if (write(fd, value, strlen(value)) < 0)
Expand Down
Loading