admin
68684892d8
The Hub config-apply handler wrote controller.yaml 0644; it holds cf_api_token, cf_tunnel_token and hub api_key in plaintext. New writeConfig0600 helper writes 0600 atomically (tmp+rename, bind-mount fallback) and chmods to enforce 0600 even when the file pre-existed 0644 (os.WriteFile doesn't chmod existing files). Test asserts mode 0600 (Linux; skipped on Windows). Setup path already used 0600.
40 lines
1.1 KiB
Go
40 lines
1.1 KiB
Go
package api
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"runtime"
|
|
"testing"
|
|
)
|
|
|
|
// TestWriteConfig0600 asserts F8: controller.yaml is persisted 0600 (it holds infra secrets), even when
|
|
// the target file already existed with looser (0644) permissions. POSIX modes only — skipped on Windows.
|
|
func TestWriteConfig0600(t *testing.T) {
|
|
if runtime.GOOS == "windows" {
|
|
t.Skip("POSIX file modes not represented on Windows")
|
|
}
|
|
dir := t.TempDir()
|
|
path := filepath.Join(dir, "controller.yaml")
|
|
|
|
// Pre-create with world-readable 0644 to prove the helper tightens an existing file.
|
|
if err := os.WriteFile(path, []byte("old: true\n"), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
if err := writeConfig0600(path, []byte("hub:\n api_key: redacted\n")); err != nil {
|
|
t.Fatalf("writeConfig0600: %v", err)
|
|
}
|
|
|
|
fi, err := os.Stat(path)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if mode := fi.Mode().Perm(); mode != 0o600 {
|
|
t.Fatalf("config mode = %o, want 0600", mode)
|
|
}
|
|
// No leftover temp file.
|
|
if _, err := os.Stat(path + ".tmp"); !os.IsNotExist(err) {
|
|
t.Fatalf("temp file not cleaned up")
|
|
}
|
|
}
|