From 86ab95891140258fc14485f099f493237d401018 Mon Sep 17 00:00:00 2001
From: lunanting <lunanting@noreply.git.1080p.hk>
Date: Sat, 12 Sep 2026 16:58:00 +0800
Subject: [PATCH] security: restrict bootstrap state permissions

---
 remote-access/server/docker-entrypoint.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/remote-access/server/docker-entrypoint.sh b/remote-access/server/docker-entrypoint.sh
index 37288dd..943797e 100644
--- a/remote-access/server/docker-entrypoint.sh
+++ b/remote-access/server/docker-entrypoint.sh
@@ -1,5 +1,6 @@
 #!/bin/sh
 set -eu
+umask 077
 
 ca_key=${BOOTSTRAP_SSH_CA_KEY:-/var/lib/cangku-bootstrap/ssh_user_ca}
 if [ ! -f "$ca_key" ]; then