vcsh: Initialize repos with --shared=0600

Configurations and other dotdir content may be highly confidential.

Ensure we're not leaking/exposing information by making vcsh
repositories user-accessible, only.

Thanks to Enrico Zini for realizing this was a problem.

diff --git a/vcsh b/vcsh
index 5d502e7c68f372a427f0ad68e62bc8938899cead..993c8ed3443cfd1300687a9f705540e63ed9199c 100755 (executable)
--- a/vcsh
+++ b/vcsh
@@ -221,7 +221,7 @@ init() {
        [ ! -e "$GIT_DIR" ] || fatal "'$GIT_DIR' exists" 10
        mkdir -p "$VCSH_BASE" || fatal "could not create '$VCSH_BASE'" 50
        cd "$VCSH_BASE" || fatal "could not enter '$VCSH_BASE'" 11
-       git init
+       git init --shared=0600
        upgrade
        hook post-init
 }