From 199f474e49dcfcf91ee16b6b0e2d32e0136a5811 Mon Sep 17 00:00:00 2001
From: m8in <m8in@gmx.de>
Date: Tue, 8 Sep 2026 00:18:42 +0200
Subject: [PATCH] Setting permissions for SSL files

---
 setupCoreOntoThisHost.sh | 18 ++++++++++++++++++
 updateRepositories.sh    |  8 ++++----
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/setupCoreOntoThisHost.sh b/setupCoreOntoThisHost.sh
index e3f9322..af8244e 100755
--- a/setupCoreOntoThisHost.sh
+++ b/setupCoreOntoThisHost.sh
@@ -115,6 +115,22 @@ function getRemoteRepositoryPath() {
     return 1
 }
 
+function setSSLPermissions(){
+    local _SSLPATHS
+    _SSLPATHS="${CIS[DOMAINSTATES]}hosts/*/etc/ssl/domains/"
+    readonly _SSLPATHS
+
+    addgroup --gid 775 ssl 2> /dev/null
+    for _path in ${_SSLPATHS}; do
+        [ -d "${_path}" ] || continue
+        chown -R root:ssl "${_path}"
+        chmod -R o-rwx "${_path}"
+        find "${_path}" -type d -exec chmod g+s {} +
+    done
+
+    return 0
+}
+
 function addDefinition(){
     local _REPOSITORY
     _REPOSITORY="$(getRemoteRepositoryPath)cis-definition-${CIS[DOMAIN]}.git"
@@ -147,6 +163,8 @@ function addState() {
         && echo "Running setup as 'root' trying to add state repository:" \
         && "${CIS[COREROOT]:?"Missing CORE_SCRIPTS"}addAndCheckGitRepository.sh" "${CIS[DOMAINSTATES]}" writable "${_REPOSITORY}" \
         && echo "  - states are usable for this host." \
+        && setSSLPermissions \
+        && echo "  - permissions for SSL are set." \
         && return 0
 
     [ "$(id -u)" != "0" ] \
diff --git a/updateRepositories.sh b/updateRepositories.sh
index 29bf00f..25bdde7 100755
--- a/updateRepositories.sh
+++ b/updateRepositories.sh
@@ -29,14 +29,14 @@ function update_repositories() {
     [ "${_MODE}" == "--repair" ] \
         && (git -C "${CIS[ROOT]:?"Missing CISROOT"}" reset --hard origin/main; \
             git -C "${CIS[DOMAINDEFINITIONS]:?"Missing DEFINITIONS"}" reset --hard origin/main; \
-            git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" reset --hard origin/main; \
+            umask 0027; git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" reset --hard origin/main; \
             echo "Run repairs") \
         && return 0
 
     [ "${_MODE}" == "--test" ] \
         && git -C "${CIS[ROOT]:?"Missing CISROOT"}" pull \
         && git -C "${CIS[DOMAINDEFINITIONS]:?"Missing DEFINITIONS"}" pull \
-        && git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" pull \
+        && (umask 0027; git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" pull) \
         && echo "Run in testMode successfully." \
         && return 0
 
@@ -54,7 +54,7 @@ function update_repositories() {
 
     [ "${_MODE}" == "--states" ] \
         && printf -- "Host ${HOSTNAME} updating states: ${CIS[DOMAINSTATES]:?"Missing STATES"} ... " \
-        && (git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" pull &> /dev/null) \
+        && (umask 0027; git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" pull &> /dev/null) \
         && echo "(done)" \
         && return 0
 
@@ -62,7 +62,7 @@ function update_repositories() {
         && printf -- "Host ${HOSTNAME} updating core including scripts, definitions and states ... " \
         && (git -C "${CIS[ROOT]:?"Missing CISROOT"}" pull &> /dev/null) \
         && (git -C "${CIS[DOMAINDEFINITIONS]:?"Missing DEFINITIONS"}" pull &> /dev/null) \
-        && (git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" pull &> /dev/null) \
+        && (umask 0027; git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" pull &> /dev/null) \
         && echo "(done)" \
         && return 0