rspamd: set permissions on files containing passwords

Author: jnorell

install/lib/installer_base.lib.php

@@ -1914,8 +1914,10 @@ public function configure_rspamd() {
 			rename("/etc/rspamd/local.d/greylist.conf", "/etc/rspamd/local.d/greylist.old");
 		}
 
-
 		exec('chmod a+r /etc/rspamd/local.d/* /etc/rspamd/local.d/maps.d/* /etc/rspamd/override.d/*');
+		# protect passwords in these files
+		exec('chgrp _rspamd /etc/rspamd/local.d/redis.conf /etc/rspamd/local.d/classifier-bayes.conf /etc/rspamd/local.d/worker-controller.inc');
+		exec('chmod 640 /etc/rspamd/local.d/redis.conf /etc/rspamd/local.d/classifier-bayes.conf /etc/rspamd/local.d/worker-controller.inc');
 
 		# unneccesary, since this was done above?
 		$command = 'usermod -a -G amavis _rspamd';

server/plugins-available/rspamd_plugin.inc.php

@@ -536,6 +536,11 @@ function server_update($event_name, $data) {
 				$app->services->restartServiceDelayed('rspamd', 'reload');
 			}
 		}
+
+		# protect passwords in these files
+		exec('chgrp _rspamd /etc/rspamd/local.d/redis.conf /etc/rspamd/local.d/classifier-bayes.conf /etc/rspamd/local.d/worker-controller.inc');
+		exec('chmod 640 /etc/rspamd/local.d/redis.conf /etc/rspamd/local.d/classifier-bayes.conf /etc/rspamd/local.d/worker-controller.inc');
+
 	}
 
 	private function _is_valid_ip_address($ip) {