2026-08-16 18:06:22 +00:00
1 changed files with 5 additions and 1 deletions
@@ -740,7 +740,11 @@ if [[ -d "$TARGET_DIR/fleet/agents" ]]; then
    warn "Could not set 0700 on $TARGET_DIR/fleet/agents — agent sessions will fail to start as unsafe-permissions."
 fi
 # credentials/ holds secrets and was never meant to be group-readable either.
-chmod 700 "$TARGET_DIR/credentials" 2>/dev/null || true
+# It is not on the fleet boundary, so a failure here breaks nothing — but it is
+# the one directory where a silently-failed chmod leaves secrets group-readable,
+# which is precisely the failure worth a line in the output.
+chmod 700 "$TARGET_DIR/credentials" 2>/dev/null || \
+  warn "Could not set 0700 on $TARGET_DIR/credentials — stored secrets may be readable by other users on this host."

 # Repair an existing tree. The umask above only governs directories this run
 # creates, so a host installed under umask 002 before this fix keeps its 0775