From 8ae192a4232056f500a493716d58b6ba732ea54d Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Wed, 7 Aug 2024 10:27:39 +0200 Subject: [PATCH] Make systemd use 0700 mode on cache folders The provided gssproxy.service unit configures /var/lib/gssproxy/clients and /var/lib/gssproxy/rcache as "StateDirectory". However, systemd applies mode 0755 by default on such folders. "StateDirectoryMode" has to be set too to restrict access to root only. Signed-off-by: Julien Rische --- systemd/gssproxy.service.in | 1 + 1 file changed, 1 insertion(+) diff --git a/systemd/gssproxy.service.in b/systemd/gssproxy.service.in index 0db9a9d..9b8c45a 100644 --- a/systemd/gssproxy.service.in +++ b/systemd/gssproxy.service.in @@ -6,6 +6,7 @@ Before=rpc-gssd.service [Service] ConfigurationDirectory=gssproxy StateDirectory=gssproxy gssproxy/clients gssproxy/rcache +StateDirectoryMode=0700 Environment=KRB5RCACHEDIR=/var/lib/gssproxy/rcache ExecStart=@sbindir@/gssproxy -i # This can be changed to notify-reload and ExecReload= can be removed once