Certbot-auto has insecure permissions!

[joohoi]

@istler

When the folder /opt has write access to everyone, an the folder /opt/letsencrypt has only write access to root, than only root can change the privilege from the folder letsencrypt, not erveryone. But everyone can create a new folder / file in the folder /opt.

Sorry for being late in the game. If everyone has write access to /opt, then anyone could do:

mv /opt/letsencrypt /opt/somethingelse
mkdir /opt/letsencrypt
echo 'echo owned >> /root/owned' > /opt/letsencrypt/letsencrypt-auto
chmod -R a+x /opt/letsencrypt

and it would fire the next time the root cronjob runs letsencrypt-auto with root privileges.