From 7a68bab085944f98992b523ae932e0e4119476ee Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Wed, 8 Dec 2021 14:31:06 +0100
Subject: [PATCH] firmware: deleting the file under configd execution and
 copy...; closes #5396

... leaves us with permission 640 even though we have copied a
644 file.  Removing the unlink() makes this work without a
chmod but the unlink is there for the fact that /etc/ssl/cert.pem
used to be a symlink and could clobber the actual file linked
which was the original package provided.

Might be an umask issue, but better leave it where it is.
---
 src/etc/inc/system.inc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/etc/inc/system.inc b/src/etc/inc/system.inc
index 1beab3c21..6ab8f75f3 100644
--- a/src/etc/inc/system.inc
+++ b/src/etc/inc/system.inc
@@ -738,6 +738,7 @@ function system_trust_configure($verbose = false)
         copy($ca_cert_pem, '/usr/local/etc/ssl/cert.pem');
         @unlink('/etc/ssl/cert.pem'); /* do not clobber symlink target */
         copy($ca_cert_pem, '/etc/ssl/cert.pem');
+        chmod('/etc/ssl/cert.pem', 0644);
     }
 
     if ($verbose) {