From 692cea49f85a0e33651bf5f7732da1b66db7272d Mon Sep 17 00:00:00 2001
From: Miroslav Lichvar <mlichvar@redhat.com>
Date: Wed, 12 Sep 2018 10:43:01 +0200
Subject: [PATCH] doc: warn about permissions in keyfile description

---
 doc/chrony.conf.adoc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/doc/chrony.conf.adoc b/doc/chrony.conf.adoc
index 4a39c21..c4c7f68 100644
--- a/doc/chrony.conf.adoc
+++ b/doc/chrony.conf.adoc
@@ -2049,6 +2049,10 @@ that has password shorter than 80 bits.
 The <<chronyc.adoc#keygen,*keygen*>> command of *chronyc* can be used to
 generate random keys for the key file. By default, it generates 160-bit MD5 or
 SHA1 keys.
++
+For security reasons, the file should be readable only by root and the user
+under which *chronyd* is normally running (to allow *chronyd* to re-read the
+file when the <<chronyc.adoc#rekey,*rekey*>> command is issued by *chronyc*).
 
 [[lock_all]]*lock_all*::
 The *lock_all* directive will lock chronyd into RAM so that it will never be