secureboot: restrictive file permissions

2025-03-25 11:33:11 -04:00 · 2025-03-25 11:33:11 -04:00 · 3447478847
commit 3447478847
parent eaec89e698
1 changed files with 2 additions and 0 deletions
--- a/configuration.nix
+++ b/configuration.nix
@ -86,6 +86,8 @@
      rm -fr ${config.boot.lanzaboote.pkiBundle} || true
      mkdir -p ${config.boot.lanzaboote.pkiBundle}
      ${pkgs.gnutar}/bin/tar xf ${./secrets/secureboot.tar} -C ${config.boot.lanzaboote.pkiBundle}
+      chown -R root:wheel ${config.boot.lanzaboote.pkiBundle}
+      chmod -R 700 ${config.boot.lanzaboote.pkiBundle}
    '';
  };