Don't allow anyone else to read these configs (they can contain passwords)

diff --git a/grub2.spec b/grub2.spec
index 31380d3edd5bb19943a64c6d55f97aeb696fdfa2..9a301f95ac9a046e2a5eb5b92ddfba5ecae23e21 100644 (file)
--- a/grub2.spec
+++ b/grub2.spec
@@ -745,8 +745,8 @@ fi
 # XXX: check this locale dir location and if it is neccesaary to exist on /boot
 
 %dir %{_libexecdir}/locale
-%config(noreplace) %verify(not md5 mtime size) %{_grubdir}/grub.cfg
-%config(noreplace) %verify(not md5 mtime size) %{_grubdir}/custom.cfg
+%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) %{_grubdir}/grub.cfg
+%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) %{_grubdir}/custom.cfg
 
 # generated by grub at runtime
 %ghost %{_grubdir}/device.map