From cd48d6ee6fbb6977d52286fae4ca2db7c28f6c26 Mon Sep 17 00:00:00 2001 From: Ondrej Holecek Date: Mon, 29 Jun 2026 16:15:08 +0200 Subject: [PATCH] Create service files with only read permissions --- mgradm/shared/coco/coco.go | 2 +- mgradm/shared/hub/xmlrpcapi.go | 2 +- mgradm/shared/pgsql/pgsql.go | 2 +- mgradm/shared/saline/saline.go | 2 +- mgradm/shared/tftp/tftp.go | 2 +- uyuni-tools.changes.oholecek.no_exec_services | 1 + 6 files changed, 6 insertions(+), 5 deletions(-) create mode 100644 uyuni-tools.changes.oholecek.no_exec_services diff --git a/mgradm/shared/coco/coco.go b/mgradm/shared/coco/coco.go index 03ca3a2eff2..c38ba6c2375 100644 --- a/mgradm/shared/coco/coco.go +++ b/mgradm/shared/coco/coco.go @@ -95,7 +95,7 @@ func writeCocoServiceFiles( log.Info().Msg(L("Setting up confidential computing attestation service")) if err := utils.WriteTemplateToFile(attestationData, - podman.GetServicePath(podman.ServerAttestationService+"@"), 0555, true); err != nil { + podman.GetServicePath(podman.ServerAttestationService+"@"), 0444, true); err != nil { return utils.Errorf(err, L("failed to generate systemd service unit file")) } diff --git a/mgradm/shared/hub/xmlrpcapi.go b/mgradm/shared/hub/xmlrpcapi.go index 21f4236503c..fbc813fe283 100644 --- a/mgradm/shared/hub/xmlrpcapi.go +++ b/mgradm/shared/hub/xmlrpcapi.go @@ -114,7 +114,7 @@ func generateHubXmlrpcSystemdService(systemd podman.Systemd, image string, serve ServerHost: serverHost, } if err := utils.WriteTemplateToFile( - hubXmlrpcData, podman.GetServicePath(podman.HubXmlrpcService+"@"), 0555, true, + hubXmlrpcData, podman.GetServicePath(podman.HubXmlrpcService+"@"), 0444, true, ); err != nil { return utils.Errorf(err, L("failed to generate systemd service unit file")) } diff --git a/mgradm/shared/pgsql/pgsql.go b/mgradm/shared/pgsql/pgsql.go index 48c047575b0..914c00f83e5 100644 --- a/mgradm/shared/pgsql/pgsql.go +++ b/mgradm/shared/pgsql/pgsql.go @@ -113,7 +113,7 @@ func GeneratePgsqlSystemdService( ReportPassword: podman.ReportDBPassSecret, } if err := utils.WriteTemplateToFile( - pgsqlData, podman.GetServicePath(podman.DBService), 0555, true, + pgsqlData, podman.GetServicePath(podman.DBService), 0444, true, ); err != nil { return utils.Error(err, L("failed to generate systemd service unit file")) } diff --git a/mgradm/shared/saline/saline.go b/mgradm/shared/saline/saline.go index 7120b847a88..39fdae69602 100644 --- a/mgradm/shared/saline/saline.go +++ b/mgradm/shared/saline/saline.go @@ -88,7 +88,7 @@ func writeSalineServiceFiles( log.Info().Msg(L("Setting up Saline service")) if err := utils.WriteTemplateToFile(salineData, - podman.GetServicePath(podman.SalineService+"@"), 0555, true); err != nil { + podman.GetServicePath(podman.SalineService+"@"), 0444, true); err != nil { return utils.Error(err, L("failed to generate systemd service unit file")) } diff --git a/mgradm/shared/tftp/tftp.go b/mgradm/shared/tftp/tftp.go index 01a1c72a4e2..f3cbb7b55a6 100644 --- a/mgradm/shared/tftp/tftp.go +++ b/mgradm/shared/tftp/tftp.go @@ -90,7 +90,7 @@ func generateTFTPSystemdService(systemd podman.Systemd, image string, fqdn strin ServerFQDN: fqdn, } if err := utils.WriteTemplateToFile( - tftpData, podman.GetServicePath(podman.TFTPService), 0555, true, + tftpData, podman.GetServicePath(podman.TFTPService), 0444, true, ); err != nil { return utils.Errorf(err, L("failed to generate systemd service unit file")) } diff --git a/uyuni-tools.changes.oholecek.no_exec_services b/uyuni-tools.changes.oholecek.no_exec_services new file mode 100644 index 00000000000..2855ef8eb0d --- /dev/null +++ b/uyuni-tools.changes.oholecek.no_exec_services @@ -0,0 +1 @@ +- Create service files with only read permissions