lacme: Default mode for certificate(-chain) creation is 0644 minus umask restrictions.

Also, always spawn the client with umask 0022 so a starting lacme(8)
with a restrictive umask doesn't impede serving challenge response
files.

1 files changed, 1 insertions, 0 deletions

diff --git a/lacme b/lacme
index 2366830..9012890 100755
--- a/lacme
+++ b/lacme
@@ -581,6 +581,7 @@ sub acme_client($@) {
     set_FD_CLOEXEC($client, 1);
     my $rv = spawn({in => $args->{in}, out => $args->{out}, child => sub() {
         drop_privileges($conf->{user}, $conf->{group}, $args->{chdir} // '/');
+        umask(0022) // die;
         set_FD_CLOEXEC($_, 0) foreach ($CONFFILE, $client);
         seek($CONFFILE, SEEK_SET, 0) or die "seek: $!";
         $ENV{DEBUG} = $OPTS{debug} // 0;