From 7531ac20dbee3a4e9951e6f22a8d55cb5b9b810c Mon Sep 17 00:00:00 2001 From: Zach Wasserman Date: Mon, 30 Jan 2023 19:28:56 -0600 Subject: [PATCH] Use stricter file permissions in `fleetctl updates add` (#9516) This resolves an issue with adding updates on a macOS 13 machine. It seems like macOS may have changed the default directory permissions and these new stricter permissions are compatible with that default. This is the error that was encountered before these changes: ``` Error: create dst dir for copy: Path staged/targets already exists with mode 20000000700 instead of the expected 20000000755 ``` # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [x] Manual QA for all new/changed functionality --- changes/fleetctl-update-permissions | 1 + ee/fleetctl/updates.go | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) create mode 100644 changes/fleetctl-update-permissions diff --git a/changes/fleetctl-update-permissions b/changes/fleetctl-update-permissions new file mode 100644 index 0000000000..f16b20ea4b --- /dev/null +++ b/changes/fleetctl-update-permissions @@ -0,0 +1 @@ +* Use stricter file permissions in `fleetctl updates add` command. diff --git a/ee/fleetctl/updates.go b/ee/fleetctl/updates.go index 2c1c9bd368..1d5674db88 100644 --- a/ee/fleetctl/updates.go +++ b/ee/fleetctl/updates.go @@ -595,11 +595,11 @@ func copyTarget(srcPath, dstPath string) error { } defer src.Close() - if err := secure.MkdirAll(filepath.Dir(dstPath), 0o755); err != nil { + if err := secure.MkdirAll(filepath.Dir(dstPath), 0o700); err != nil { return fmt.Errorf("create dst dir for copy: %w", err) } - dst, err := secure.OpenFile(dstPath, os.O_RDWR|os.O_CREATE, 0o644) + dst, err := secure.OpenFile(dstPath, os.O_RDWR|os.O_CREATE, 0o600) if err != nil { return fmt.Errorf("open dst for copy: %w", err) }