[PATCH] wg-tools: Fix too strict file permissions on resolv.conf

[PATCH] wg-tools: Fix too strict file permissions on resolv.conf

[Florian Bausch]

Hi,

I hardened my system by setting a strict umask of 077 in 
/etc/login.defs. However, this breaks DNS as soon as wg-quick is used to 
bring up a WireGuard tunnel. This is, because the strict umask value 
will be applied to /etc/resolv.conf (at least if the DNS hatchet is 
used) and therefore, unprivileged processes are not able to read 
/etc/resolv.conf.

While the behavior can be worked around by setting umask in other 
places, the fix below would prevent this behavior to occur. The umask 
022 is applied before creating the new /etc/resolv.conf in the DNS hatchet.

Kind regards

---
  contrib/dns-hatchet/hatchet.bash | 1 +
  1 file changed, 1 insertion(+)

diff --git a/contrib/dns-hatchet/hatchet.bash 
b/contrib/dns-hatchet/hatchet.bash
index bc4d090..807a14a 100644
--- a/contrib/dns-hatchet/hatchet.bash
+++ b/contrib/dns-hatchet/hatchet.bash
@@ -20,6 +20,7 @@ set_dns() {
  		[[ ${#DNS_SEARCH[@]} -eq 0 ]] || printf 'search %s\n' "${DNS_SEARCH[*]}"
  		} | unshare -m --propagation shared bash -c "$(cat <<-_EOF
  			set -e
+			umask 022
  			context="\$(stat -c %C /etc/resolv.conf 2>/dev/null)" || unset context
  			mount --make-private /dev/shm
  			mount -t tmpfs none /dev/shm
-- 
2.39.1

Re: [PATCH] wg-tools: Fix too strict file permissions on resolv.conf

[Jason A. Donenfeld]

Thanks.

Can you send this with a `Signed-off-by:` line like every commit in
that repository does, please? Then I'll apply this.

Jason

Re: [PATCH] wg-tools: Fix too strict file permissions on resolv.conf

[Florian Bausch]

[-- Attachment #1: Type: text/plain, Size: 1252 bytes --]

Hi,

I hardened my system by setting a strict umask of 077 in
/etc/login.defs. However, this breaks DNS as soon as wg-quick is used to
bring up a WireGuard tunnel. This is, because the strict umask value
will be applied to /etc/resolv.conf (at least if the DNS hatchet is
used) and therefore, unprivileged processes are not able to read
/etc/resolv.conf.

While the behavior can be worked around by setting umask in other
places, the fix below would prevent this behavior to occur. The umask
022 is applied before creating the new /etc/resolv.conf in the DNS hatchet.

Kind regards

Signed-off-by: Florian Bausch <fbausch@ernw.de>
---
  contrib/dns-hatchet/hatchet.bash | 1 +
  1 file changed, 1 insertion(+)

diff --git a/contrib/dns-hatchet/hatchet.bash 
b/contrib/dns-hatchet/hatchet.bash
index bc4d090..807a14a 100644
--- a/contrib/dns-hatchet/hatchet.bash
+++ b/contrib/dns-hatchet/hatchet.bash
@@ -20,6 +20,7 @@ set_dns() {
  		[[ ${#DNS_SEARCH[@]} -eq 0 ]] || printf 'search %s\n' "${DNS_SEARCH[*]}"
  		} | unshare -m --propagation shared bash -c "$(cat <<-_EOF
  			set -e
+			umask 022
  			context="\$(stat -c %C /etc/resolv.conf 2>/dev/null)" || unset context
  			mount --make-private /dev/shm
  			mount -t tmpfs none /dev/shm
-- 
2.39.1

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4819 bytes --]

Re: [PATCH] wg-tools: Fix too strict file permissions on resolv.conf

[Florian Bausch]

(This time without signature)
Hi,

I hardened my system by setting a strict umask of 077 in
/etc/login.defs. However, this breaks DNS as soon as wg-quick is used to
bring up a WireGuard tunnel. This is, because the strict umask value
will be applied to /etc/resolv.conf (at least if the DNS hatchet is
used) and therefore, unprivileged processes are not able to read
/etc/resolv.conf.

While the behavior can be worked around by setting umask in other
places, the fix below would prevent this behavior to occur. The umask
022 is applied before creating the new /etc/resolv.conf in the DNS hatchet.

Kind regards

Signed-off-by: Florian Bausch <fbausch@ernw.de>
---
  contrib/dns-hatchet/hatchet.bash | 1 +
  1 file changed, 1 insertion(+)

diff --git a/contrib/dns-hatchet/hatchet.bash 
b/contrib/dns-hatchet/hatchet.bash
index bc4d090..807a14a 100644
--- a/contrib/dns-hatchet/hatchet.bash
+++ b/contrib/dns-hatchet/hatchet.bash
@@ -20,6 +20,7 @@ set_dns() {
          [[ ${#DNS_SEARCH[@]} -eq 0 ]] || printf 'search %s\n' 
"${DNS_SEARCH[*]}"
          } | unshare -m --propagation shared bash -c "$(cat <<-_EOF
              set -e
+            umask 022
              context="\$(stat -c %C /etc/resolv.conf 2>/dev/null)" || 
unset context
              mount --make-private /dev/shm
              mount -t tmpfs none /dev/shm
-- 
2.39.1