git: 02f174179a53 - main - certctl: Enforce 0444 mode on new files

The branch main has been updated by ivy:

URL: https://cgit.FreeBSD.org/src/commit/?id=02f174179a538f89185d275b4e64277baf3acc50

commit 02f174179a538f89185d275b4e64277baf3acc50
Author:     Lexi Winter <ivy@FreeBSD.org>
AuthorDate: 2026-07-19 12:45:43 +0000
Commit:     Lexi Winter <ivy@FreeBSD.org>
CommitDate: 2026-07-19 12:45:43 +0000

    certctl: Enforce 0444 mode on new files
    
    When writing to a file, call fchmod() to ensure the file mode matches
    the intended mode, which is 0444.  This was already done when replacing
    an existing file, but not when creating a new file, which meant if the
    process umask was 077, the resulting certificates and bundle would be
    unreadable by unprivileged users.
    
    MFC after:      1 week
    Reviewed by:    des
    Differential Revision:  https://reviews.freebsd.org/D58304
---
 usr.sbin/certctl/certctl.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/usr.sbin/certctl/certctl.c b/usr.sbin/certctl/certctl.c
index 462f6c1730a9..5c2b83b89d57 100644
--- a/usr.sbin/certctl/certctl.c
+++ b/usr.sbin/certctl/certctl.c
@@ -523,6 +523,8 @@ write_certs(const char *dir, struct cert_tree *tree)
 				tmppath = xasprintf(".%s", path);
 				fd = openat(d, tmppath,
 				    O_CREAT | O_WRONLY | O_EXCL, mode);
+				if (!unprivileged && fd >= 0)
+					(void)fchmod(fd, mode);
 			}
 		}
 		/* write the certificate */
@@ -594,6 +596,8 @@ write_bundle(const char *dir, const char *file, struct cert_tree *tree)
 	} else {
 		tmpfile = xasprintf(".%s", file);
 		fd = openat(d, tmpfile, O_WRONLY | O_CREAT | O_EXCL, mode);
+		if (!unprivileged && fd >= 0)
+			(void)fchmod(fd, mode);
 	}
 	if (fd < 0 || (f = fdopen(fd, "w")) == NULL) {
 		if (tmpfile != NULL && fd >= 0) {