vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: matrix registration token 0o640 -> 0o600

Browse source
This commit is contained in:
damocles 2026-05-31 23:31:39 +02:00 • committed by mara
commit d266889263
1 changed files with 1 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

8
hive-c0re/src/matrix.rs
View file

@ -99,13 +99,7 @@ pub fn ensure_register_token() -> Result<String> {
}
std::fs::write(path, format!("{token}\n"))
.with_context(|| format!("write registration token to {}", path.display()))?;
// Mode 0640 (group-readable for tuwunel via the host-side
// activation script's chown). 0600 blocks tuwunel; 0644
// world-reads the token. The activation script reconciles
// chown + chmod on every boot, so this write is best-effort.
// See `docs/matrix.md::Provisioning flow (registration token)`
// for the host/container permission split.
let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o640));
let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600));
tracing::info!(path = %path.display(), "matrix: generated registration token");
Ok(token)
}