From 3250929b7049f3fbbb610a92438c8a8b638ec155 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Mon, 7 Jul 2014 16:54:09 +0200
Subject: [PATCH] firstboot: change /etc/shadow access mode to 000

It appears to be customary to remove all access bits from /etc/shadow
including those for the root owner), hence let's do the same.
---
 src/firstboot/firstboot.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
index 56893d0e3..57173a566 100644
--- a/src/firstboot/firstboot.c
+++ b/src/firstboot/firstboot.c
@@ -531,7 +531,8 @@ static int write_root_shadow(const char *path, const struct spwd *p) {
         assert(p);
 
         mkdir_parents(path, 0755);
-        f = fopen(path, "wex");
+        RUN_WITH_UMASK(0777)
+                f = fopen(path, "wex");
         if (!f)
                 return -errno;
 
-- 
2.30.2