diff --git a/pkg/config/config.go b/pkg/config/config.go index 8b7b340e7..f13cd49e4 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -36,7 +36,7 @@ const ( ) var ( - ErrKeyFileIncorrectPermission = errors.New("key file must have 0600 permission") + ErrKeyFileIncorrectPermission = errors.New("key file others permissions must be set to 0") ErrKeysNotSet = errors.New("one of key-file or keys must be provided") ) @@ -547,9 +547,10 @@ func (conf *Config) ToCLIFlagNames(existingFlags []cli.Flag) map[string]reflect. func (conf *Config) ValidateKeys() error { // prefer keyfile if set if conf.KeyFile != "" { + var otherFilter os.FileMode = 0007 if st, err := os.Stat(conf.KeyFile); err != nil { return err - } else if st.Mode().Perm() != 0600 { + } else if st.Mode().Perm()&otherFilter != 0000 { return ErrKeyFileIncorrectPermission } f, err := os.Open(conf.KeyFile) diff --git a/pkg/service/wire.go b/pkg/service/wire.go index 126542780..bb8451e05 100644 --- a/pkg/service/wire.go +++ b/pkg/service/wire.go @@ -87,10 +87,11 @@ func getNodeID(currentNode routing.LocalNode) livekit.NodeID { func createKeyProvider(conf *config.Config) (auth.KeyProvider, error) { // prefer keyfile if set if conf.KeyFile != "" { + var otherFilter os.FileMode = 0007 if st, err := os.Stat(conf.KeyFile); err != nil { return nil, err - } else if st.Mode().Perm() != 0600 { - return nil, fmt.Errorf("key file must have permission set to 600") + } else if st.Mode().Perm()&otherFilter != 0000 { + return nil, fmt.Errorf("key file others permissions must be set to 0") } f, err := os.Open(conf.KeyFile) if err != nil { diff --git a/pkg/service/wire_gen.go b/pkg/service/wire_gen.go index 1ce19893a..ec817449d 100644 --- a/pkg/service/wire_gen.go +++ b/pkg/service/wire_gen.go @@ -132,10 +132,11 @@ func getNodeID(currentNode routing.LocalNode) livekit.NodeID { func createKeyProvider(conf *config.Config) (auth.KeyProvider, error) { if conf.KeyFile != "" { + var otherFilter os.FileMode = 0007 if st, err := os.Stat(conf.KeyFile); err != nil { return nil, err - } else if st.Mode().Perm() != 0600 { - return nil, fmt.Errorf("key file must have permission set to 600") + } else if st.Mode().Perm()&otherFilter != 0000 { + return nil, fmt.Errorf("key file others permission must be set to 0") } f, err := os.Open(conf.KeyFile) if err != nil {