From b1387bd6548a6925ddbf2af2b5ad1393d350770a Mon Sep 17 00:00:00 2001
From: boban <boban@git.bave.dev>
Date: Sun, 21 Jun 2026 00:42:07 +0200
Subject: [PATCH] =?UTF-8?q?fix(wg):=20umask=20077=20in=20serve-request=20+?=
 =?UTF-8?q?=20UMask=20in=20unit=20=E2=80=94=20no=200644=20race=20on=20key?=
 =?UTF-8?q?=20files=20(security=20review)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 docker/wg/clusev-wg-request.service | 2 ++
 docker/wg/clusev-wg.sh              | 1 +
 2 files changed, 3 insertions(+)

diff --git a/docker/wg/clusev-wg-request.service b/docker/wg/clusev-wg-request.service
index 337a0c2..ed07f7c 100644
--- a/docker/wg/clusev-wg-request.service
+++ b/docker/wg/clusev-wg-request.service
@@ -9,6 +9,8 @@ After=docker.service
 [Service]
 Type=oneshot
 User=root
+# Result/QR files carry a freshly-minted private key — keep them 0600 from birth (run/ is 0775).
+UMask=0077
 Environment=CLUSEV_DIR=/home/nexxo/clusev
 WorkingDirectory=/home/nexxo/clusev
 ExecStart=/home/nexxo/clusev/docker/wg/clusev-wg.sh serve-request
diff --git a/docker/wg/clusev-wg.sh b/docker/wg/clusev-wg.sh
index 3c5842b..2e31ec2 100755
--- a/docker/wg/clusev-wg.sh
+++ b/docker/wg/clusev-wg.sh
@@ -311,6 +311,7 @@ _write_result() {
 # Process one UI write-request. Whitelists the action + re-validates every arg HOST-SIDE.
 cmd_serve_request() {
   need_root serve-request
+  umask 077   # result + QR sidecar carry a private key — born 0600, never world-readable in run/ (0775)
   local req="${RUN_DIR}/wg-request.json" work="${RUN_DIR}/wg-request.processing"
   [ -f "$req" ] || return 0
   mv -f "$req" "$work" 2>/dev/null || return 0