As the title states 0644 open read access to public/guest which a secret key should primarily be 0600 so only the user or 0640 for user/group has read access. I dont see why a external none defined user should have read access to the private key file unless newt drops permissions to a lower user.
Originally created by @LaurenceJJones on GitHub (Aug 11, 2025).
Original GitHub issue: https://github.com/fosrl/newt/issues/104
Originally assigned to: @oschwartz10612 on GitHub.
https://github.com/fosrl/newt/blob/151d0e38e6b6f63335d9a1023bb8d2da2d3bccb0/wg/wg.go#L173
https://github.com/fosrl/newt/blob/151d0e38e6b6f63335d9a1023bb8d2da2d3bccb0/wgnetstack/wgnetstack.go#L199
As the title states 0644 open read access to public/guest which a secret key should primarily be 0600 so only the user or 0640 for user/group has read access. I dont see why a external none defined user should have read access to the private key file unless newt drops permissions to a lower user.
@oschwartz10612 commented on GitHub (Aug 11, 2025):
Good point I think you are right we should make it 0600 as is customary! I dont see a reason not to right now. Docker might get funny but it should always be the same user inside of docker.
<!-- gh-comment-id:3175314053 -->
@oschwartz10612 commented on GitHub (Aug 11, 2025):
Good point I think you are right we should make it 0600 as is customary! I dont see a reason not to right now. Docker might get funny but it should always be the same user inside of docker.
@LaurenceJJones commented on GitHub (Aug 11, 2025):
Note you may want to also check gerbil as I think it has the same 0644 writes.
Also thanks for quick response! ❤️
<!-- gh-comment-id:3175398791 -->
@LaurenceJJones commented on GitHub (Aug 11, 2025):
Note you may want to also check gerbil as I think it has the same `0644` writes.
Also thanks for quick response! ❤️
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @LaurenceJJones on GitHub (Aug 11, 2025).
Original GitHub issue: https://github.com/fosrl/newt/issues/104
Originally assigned to: @oschwartz10612 on GitHub.
https://github.com/fosrl/newt/blob/151d0e38e6b6f63335d9a1023bb8d2da2d3bccb0/wg/wg.go#L173
https://github.com/fosrl/newt/blob/151d0e38e6b6f63335d9a1023bb8d2da2d3bccb0/wgnetstack/wgnetstack.go#L199
As the title states 0644 open read access to public/guest which a secret key should primarily be 0600 so only the user or 0640 for user/group has read access. I dont see why a external none defined user should have read access to the private key file unless newt drops permissions to a lower user.
@oschwartz10612 commented on GitHub (Aug 11, 2025):
Good point I think you are right we should make it 0600 as is customary! I dont see a reason not to right now. Docker might get funny but it should always be the same user inside of docker.
@LaurenceJJones commented on GitHub (Aug 11, 2025):
Note you may want to also check gerbil as I think it has the same
0644writes.Also thanks for quick response! ❤️