restrict access to /etc/unbound/{,unbound.conf}

/etc/unbound dir:
- own by unbound user
- allow only exec bit for others

/etc/unbound/unbound.conf file:
- own by unbound user
- disallow access for others

diff --git a/unbound.spec b/unbound.spec
index 7419bf93c4b6a4f547857ebdb09cd9669fb4038e..abf4d4cfb53cbdae5829a7ee04f9133a58d05d02 100644 (file)
--- a/unbound.spec
+++ b/unbound.spec
@@ -220,8 +220,8 @@ fi
 %doc doc/{CREDITS,Changelog,FEATURES,LICENSE,README,TODO,control_proto_spec.txt,example.conf,ietf67-design-02.pdf,requirements.txt}
 %attr(754,root,root) /etc/rc.d/init.d/unbound
 %{systemdunitdir}/%{name}.service
-%dir %{_sysconfdir}/%{name}
-%config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/%{name}/unbound.conf
+%attr(751,unbound,root) %dir %{_sysconfdir}/%{name}
+%attr(640,unbound,root) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/%{name}/unbound.conf
 %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/%{name}/named.cache
 %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/%{name}/icannbundle.pem
 %attr(755,root,root) %{_sbindir}/unbound