feat(edh-keygen): configure shared DH parameter permissions

Add configurable ownership and permission defaults for shared DH
parameter directories and files.

Set shared DH parameter defaults to root:root, directory mode 0755, and file
mode 0644 so non-root TLS services can traverse the directory and read DH
parameter files.

Enforce configured ownership and modes after synchronization and document the
security boundary between public DH parameters and TLS private keys.

edh-keygen.sh

@@ -57,6 +57,14 @@
 tls_tmp_path='/etc/pki/tls/tmp'
 tls_private_path='/etc/pki/tls/private/'
 
+# Shared DH parameter directory ownership and permissions.
+# DH parameters are public cryptographic parameters, not private keys.
+# The default allows non-root TLS services to traverse the directory and read
+# generated DH parameter files.
+tls_private_owner='root:root'
+tls_private_dir_mode='0755'
+tls_private_file_mode='0644'
+
 # Determine config file: prefer edh-keygen.local, else use edh-keygen.conf
 script_dir=$(dirname "$0")
 if [ -f "$script_dir/edh-keygen.local" ]; then
@@ -74,11 +82,14 @@ fi
 # Read global settings from config file
 while IFS= read -r line || [ -n "$line" ]; do
     case "$line" in
-        ''|\#*) continue ;; # Skip empty lines and comments
+        ''|\#*) continue ;;
         tls_tmp_path=*) tls_tmp_path="${line#tls_tmp_path=}" ;;
         tls_private_path=*) tls_private_path="${line#tls_private_path=}" ;;
+        tls_private_owner=*) tls_private_owner="${line#tls_private_owner=}" ;;
+        tls_private_dir_mode=*) tls_private_dir_mode="${line#tls_private_dir_mode=}" ;;
+        tls_private_file_mode=*) tls_private_file_mode="${line#tls_private_file_mode=}" ;;
         key_sizes=*) key_sizes="${line#key_sizes=}" ;;
-        *) break ;; # Stop at first non-global line (service lines start here)
+        *) break ;;
     esac
 done < "$my_service_conf"
 
@@ -110,29 +121,29 @@ for bits in $key_sizes; do
 done
 
 # Set permissions
-if ! find "$tls_tmp_path" -type f -name '*.pem' -exec chmod 644 {} \;; then
+if ! find "$tls_tmp_path" -type f -name '*.pem' -exec chmod "$tls_private_file_mode" {} \;; then
     echo "Failed to set permissions on generated DH parameters." >&2
     rm -rf "$tls_tmp_path"
     exit 1
 fi
 
 # Synchronize DH parameters from the temporary to the private directory.
+# Ensure the shared DH parameter directory exists and has the configured metadata.
 if [ ! -d "$tls_private_path" ]; then
     if ! mkdir -p "$tls_private_path"; then
         echo "Failed to create private key directory $tls_private_path." >&2
         rm -rf "$tls_tmp_path"
         exit 1
     fi
-
 fi
 
-if ! chown root:root "$tls_private_path"; then
+if ! chown "$tls_private_owner" "$tls_private_path"; then
     echo "Failed to set ownership on private key directory $tls_private_path." >&2
     rm -rf "$tls_tmp_path"
     exit 1
 fi
 
-if ! chmod 750 "$tls_private_path"; then
+if ! chmod "$tls_private_dir_mode" "$tls_private_path"; then
     echo "Failed to set permissions on private key directory $tls_private_path." >&2
     rm -rf "$tls_tmp_path"
     exit 1
@@ -152,6 +163,14 @@ for dh_file in "$tls_tmp_path"/dh_*.pem; do
     fi
 done
 
+# Enforce ownership and mode on the shared DH parameter files.
+if ! find "$tls_private_path" -maxdepth 1 -type f -name 'dh_*.pem' \
+    -exec chown "$tls_private_owner" {} \; \
+    -exec chmod "$tls_private_file_mode" {} \;; then
+    echo "Failed to set ownership or permissions on shared DH parameters." >&2
+    exit 1
+fi
+
 # Delete the temporary files
 if ! rm -rf "$tls_tmp_path"; then
     echo "Failed to remove temporary directory $tls_tmp_path." >&2