build: set permissions for /boot

Restrict these files to align with standard practice, even though all the contents are publicly available through the "boot" images in the updates repository. Signed-off-by: Ben Cressey <bcressey@amazon.com>
bottlerocket-os · Jun 17, 2022 · e8faa4b · e8faa4b
1 parent ebfbe7f
commit e8faa4b
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/tools/rpm2img b/tools/rpm2img
@@ -288,6 +288,7 @@ EOF
 
 # BOTTLEROCKET-BOOT-A
 mkdir -p "${BOOT_MOUNT}/lost+found"
+chmod -R go-rwx "${BOOT_MOUNT}"
 BOOT_LABELS=$(setfiles -n -d -F -m -r "${BOOT_MOUNT}" \
     "${SELINUX_FILE_CONTEXTS}" "${BOOT_MOUNT}" \
   | awk -v root="${BOOT_MOUNT}" '{gsub(root"/","/"); gsub(root,"/"); print "ea_set", $1, "security.selinux", $4}')