From fb44ee879a28ee3655ca1901699db1da52f316b0 Mon Sep 17 00:00:00 2001 From: Guillem Jover Date: Fri, 27 Feb 2026 20:27:36 +0100 Subject: [PATCH] MT#64527 ngcp-panel-create-keys: Fix race condition when creating TLS certs We should not create and populate the TLS keys and certificate files with the default permissions from open(), to then fix that up in a later call. Instead use the specified permissions (even if they might get restricted further by the current umask), and then we will possibly open them up again when doing the chmod(). Spotted-by: Michael Prokop Change-Id: I810e041cc4038bdaed8a3335ca45009129c928de --- tools_bin/ngcp-panel-create-keys | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tools_bin/ngcp-panel-create-keys b/tools_bin/ngcp-panel-create-keys index 663e147dd5..562c5f5c8d 100755 --- a/tools_bin/ngcp-panel-create-keys +++ b/tools_bin/ngcp-panel-create-keys @@ -108,7 +108,9 @@ sub save_pem { path_mod => $path_mod, path_owner => $path_owner, path_group => $path_group); - open(my $fh, '>', $filename) or die "Could not open file '$filename': $!\n"; + + sysopen my $fh, $filename, O_WRONLY | O_CREAT, $mod + or die "Could not open file '$filename': $!\n"; print $fh $data; close $fh; _chownmod($filename,$owner,$group,$mod);