From 0b711689b39bc9f5bd17457ecc3ec5723f6f7f5c Mon Sep 17 00:00:00 2001
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
Date: Thu, 5 Jan 2017 19:57:50 +0100
Subject: tools: wg-quick: enforce good permissions

---
 src/tools/wg-quick.bash | 1 +
 1 file changed, 1 insertion(+)

(limited to 'src/tools/wg-quick.bash')

diff --git a/src/tools/wg-quick.bash b/src/tools/wg-quick.bash
index e686d73..c9157ad 100755
--- a/src/tools/wg-quick.bash
+++ b/src/tools/wg-quick.bash
@@ -27,6 +27,7 @@ parse_options() {
 	[[ $CONFIG_FILE =~ ^[a-zA-Z0-9_=+.-]{1,16}$ ]] && CONFIG_FILE="/etc/wireguard/$CONFIG_FILE.conf"
 	[[ -e $CONFIG_FILE ]] || die "\`$CONFIG_FILE' does not exist"
 	[[ $CONFIG_FILE =~ /?([a-zA-Z0-9_=+.-]{1,16})\.conf$ ]] || die "The config file must be a valid interface name, followed by .conf"
+	((($(stat -c '%#a' "$CONFIG_FILE") & 0007) == 0)) || echo "Warning: \`$CONFIG_FILE' is world accessible" >&2
 	INTERFACE="${BASH_REMATCH[1]}"
 	shopt -s nocasematch
 	while read -r line; do
-- 
cgit v1.2.3-59-g8ed1b