security: restrict bootstrap state permissions

2026-09-12 16:58:00 +08:00 · 2026-09-12 16:58:00 +08:00 · 86ab958911
commit 86ab958911
parent 3229c2a1c3
1 changed files with 1 additions and 0 deletions
--- a/remote-access/server/docker-entrypoint.sh
+++ b/remote-access/server/docker-entrypoint.sh
@ -1,5 +1,6 @@
 #!/bin/sh
 set -eu
+umask 077

 ca_key=${BOOTSTRAP_SSH_CA_KEY:-/var/lib/cangku-bootstrap/ssh_user_ca}
 if [ ! -f "$ca_key" ]; then