diff options
| author | elara-leitstellentechnik <elara-leitstellentechnik@users.noreply.github.com> | 2023-12-08 17:25:57 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-12-08 16:25:57 +0000 |
| commit | 10ada2ff6d2a08108edf5b4dbe6562cc9465523d (patch) | |
| tree | 465854827969b72acbe8c720d9d0493ada7fa02a /synapse/config | |
| parent | Clarify documentation for `only_for_reauth` (#16737) (diff) | |
| download | synapse-10ada2ff6d2a08108edf5b4dbe6562cc9465523d.tar.xz | |
Write signing keys with file mode 0640 (#16740)
Co-authored-by: Fabian Klemp <fabian.klemp@frequentis.com>
Diffstat (limited to '')
| -rw-r--r-- | synapse/config/key.py | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/synapse/config/key.py b/synapse/config/key.py index f3dc4df695..1920498cd1 100644 --- a/synapse/config/key.py +++ b/synapse/config/key.py @@ -263,7 +263,9 @@ class KeyConfig(Config): if not self.path_exists(signing_key_path): print("Generating signing key file %s" % (signing_key_path,)) - with open(signing_key_path, "w") as signing_key_file: + with open( + signing_key_path, "w", opener=lambda p, f: os.open(p, f, mode=0o640) + ) as signing_key_file: key_id = "a_" + random_string(4) write_signing_keys(signing_key_file, (generate_signing_key(key_id),)) else: @@ -274,7 +276,9 @@ class KeyConfig(Config): key = decode_signing_key_base64( NACL_ED25519, key_id, signing_keys.split("\n")[0] ) - with open(signing_key_path, "w") as signing_key_file: + with open( + signing_key_path, "w", opener=lambda p, f: os.open(p, f, mode=0o640) + ) as signing_key_file: write_signing_keys(signing_key_file, (key,)) |