/var/lib/acme/conf/target file permission about acmetool HOT 3 OPEN

You can override permissions enforcement using this file: https://github.com/hlandau/acmetool/blob/master/_doc/contrib/perm.example

from acmetool.

Ah, thanks. That'll do it.

You might want to add it to https://github.com/hlandau/acmetool/blob/master/_doc/SCHEMA.md, too, as right now I don't think I would've discovered it without your help.

from acmetool.

I gave perm a try and if I'm not mistaken, it expects to set permissions on entire directory. I was attempting to only lock down conf/target, but that errs with:

20220314150328 [CRITICAL] acmetool: fatal: storage: open fdb: mkdir /var/lib/acme/conf/target: not a directory

That it turn makes me think that individual certs could use a permission system. For example, the private certificate for an SMTP server would need to be owned by Postfix, whereas a certificate for a web server should only be readable by it. How do you handle these situations? State directories have a very large structure overhead, so I'm not too keen on duplicating them per-service.

Thanks!

from acmetool.