From 6bdc3e17d7d496cf2c01642f59bc864628541438 Mon Sep 17 00:00:00 2001 From: Markus Hilger Date: Sun, 1 Nov 2026 22:39:31 +0100 Subject: [PATCH] Restrict the netplan file written by Ubuntu diskless boot imageboot.sh wrote /etc/netplan/10--confluentcfg.yaml with the default mode 0644, and netplan warns that its configuration should not be accessible by others. confignet already writes its files 0600, but it leaves an identical file in place, so the boot-time one stayed 0644. --- .../ubuntu20.04-diskless/profiles/default/scripts/imageboot.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/confluent_osdeploy/ubuntu20.04-diskless/profiles/default/scripts/imageboot.sh b/confluent_osdeploy/ubuntu20.04-diskless/profiles/default/scripts/imageboot.sh index 8efdef16..a690530f 100644 --- a/confluent_osdeploy/ubuntu20.04-diskless/profiles/default/scripts/imageboot.sh +++ b/confluent_osdeploy/ubuntu20.04-diskless/profiles/default/scripts/imageboot.sh @@ -237,6 +237,8 @@ EOF fi fi echo " version: 2" >> /sysroot/etc/netplan/10-${iface}-confluentcfg.yaml + # netplan warns about configuration readable by others, as confignet knows + chmod 600 /sysroot/etc/netplan/10-${iface}-confluentcfg.yaml fi if grep installtodisk /proc/cmdline > /dev/null; then . /etc/confluent/functions