Beta Branch fix cmsec-prewarm cache-dir perms + misleading comments in 140.00beta01

fix cmsec-prewarm cache-dir perms + misleading comments in 140.00beta01

Follow-up to commits 9a991fa4 + 0b2014c5. Three small corrections:

1. cmsec-prewarm.sh now explicitly chmod 0700 on the cache dir after
mkdir. cmsec.sh's cmsec_cache_dir() in lib/cache.sh only chmods
when IT creates the dir; if the prewarm mkdir wins the race the
default umask leaves /var/cache/centminmod/cmsec/ world-readable
(CVE detection state would leak to local users).
2. inc/cpcheck.inc cmsec_prewarm_cronsetup() comment corrected.
The outer grep guard short-circuits the body once any cmsec-prewarm
cron entry exists, so the inner sed never fires to update an
existing entry. Schedule changes do NOT propagate; admins must
remove the old entry first.
3. cmsec-prewarm.sh --dmotd-flag rationale corrected. is_suppressed()
runs regardless of mode; the real reason to pass --dmotd is
cache-key parity with what dmotd.sh reads back.

Changes:
- tools/cmm-security/cmsec-prewarm.sh: chmod 0700 after mkdir; rewrite --dmotd comment
- inc/cpcheck.inc: rewrite cmsec_prewarm_cronsetup leading comment

Continue reading...

---

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01