Setting restricted ACL for windows secret-orbit-node-file (#9457)

Setting restricted ACL for windows secret-orbit-node-file

orbit/changes/bug-9157-secret-orbit-node-file-is-world-accessible

@@ -0,0 +1 @@
+* Orbit service on windows is not creating the secret-orbit-node-key.txt with a restricted ACL to allow only privileged users to access its content

orbit/pkg/platform/platform_notwindows.go

@@ -13,6 +13,15 @@ import (
 	gopsutil_process "github.com/shirou/gopsutil/v3/process"
 )
 
+// ChmodRestrictFile sets the appropriate permissions on a file so it can not be read by everyone
+// On POSIX this is a normal chmod call.
+func ChmodRestrictFile(path string) error {
+	if err := os.Chmod(path, constant.DefaultFileMode); err != nil {
+		return fmt.Errorf("chmod restrict file: %w", err)
+	}
+	return nil
+}
+
 // ChmodExecutableDirectory sets the appropriate permissions on an executable
 // file. On POSIX this is a normal chmod call.
 func ChmodExecutableDirectory(path string) error {

orbit/pkg/platform/platform_windows.go

@@ -25,6 +25,23 @@ const (
 	readAndExecute = uint32(131241)
 )
 
+// ChmodRestrictFile sets the appropriate permissions on a file so it can not be read by everyone
+// On POSIX this is a normal chmod call.
+func ChmodRestrictFile(path string) error {
+	if err := acl.Apply(
+		path,
+		true,
+		false,
+		acl.GrantSid(windows.GENERIC_ALL, constant.SystemSID),
+		acl.GrantSid(windows.GENERIC_ALL, constant.AdminSID),
+		acl.GrantSid(0, constant.UserSID), // no access permissions for regular users
+	); err != nil {
+		return fmt.Errorf("restricting file access: %w", err)
+	}
+
+	return nil
+}
+
 // ChmodExecutableDirectory sets the appropriate permissions on the parent
 // directory of an executable file. On Windows this involves setting the
 // appropriate ACLs.

server/service/orbit_client.go

@@ -10,10 +10,12 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"runtime"
 	"sync"
 	"time"
 
 	"github.com/fleetdm/fleet/v4/orbit/pkg/constant"
+	"github.com/fleetdm/fleet/v4/orbit/pkg/platform"
 	"github.com/fleetdm/fleet/v4/pkg/retry"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/rs/zerolog/log"
@@ -200,9 +202,25 @@ func (oc *OrbitClient) enrollAndWriteNodeKeyFile() (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("enroll request: %w", err)
 	}
+
+	if runtime.GOOS == "windows" {
+
+		// creating the secret file with empty content
+		if err := os.WriteFile(oc.nodeKeyFilePath, nil, constant.DefaultFileMode); err != nil {
+			return "", fmt.Errorf("create orbit node key file: %w", err)
+		}
+
+		// restricting file access
+		if err := platform.ChmodRestrictFile(oc.nodeKeyFilePath); err != nil {
+			return "", fmt.Errorf("apply ACLs: %w", err)
+		}
+	}
+
+	// writing raw key material to the acl-ready secret file
 	if err := os.WriteFile(oc.nodeKeyFilePath, []byte(orbitNodeKey), constant.DefaultFileMode); err != nil {
 		return "", fmt.Errorf("write orbit node key file: %w", err)
 	}
+
 	return orbitNodeKey, nil
 }