From 86c2b9ada034a9631d164747c501c2a586da499a Mon Sep 17 00:00:00 2001
From: Marcos Oviedo <marcos@fleetdm.com>
Date: Thu, 26 Jan 2023 18:51:24 -0300
Subject: [PATCH] Setting restricted ACL for windows secret-orbit-node-file
 (#9457)

Setting restricted ACL for windows secret-orbit-node-file
---
 ...-secret-orbit-node-file-is-world-accessible |  1 +
 orbit/pkg/platform/platform_notwindows.go      |  9 +++++++++
 orbit/pkg/platform/platform_windows.go         | 17 +++++++++++++++++
 server/service/orbit_client.go                 | 18 ++++++++++++++++++
 4 files changed, 45 insertions(+)
 create mode 100644 orbit/changes/bug-9157-secret-orbit-node-file-is-world-accessible

diff --git a/orbit/changes/bug-9157-secret-orbit-node-file-is-world-accessible b/orbit/changes/bug-9157-secret-orbit-node-file-is-world-accessible
new file mode 100644
index 0000000000..0cdeda7640
--- /dev/null
+++ b/orbit/changes/bug-9157-secret-orbit-node-file-is-world-accessible
@@ -0,0 +1 @@
+* Orbit service on windows is not creating the secret-orbit-node-key.txt with a restricted ACL to allow only privileged users to access its content
diff --git a/orbit/pkg/platform/platform_notwindows.go b/orbit/pkg/platform/platform_notwindows.go
index 5f07123e8c..274a9c4fbd 100644
--- a/orbit/pkg/platform/platform_notwindows.go
+++ b/orbit/pkg/platform/platform_notwindows.go
@@ -13,6 +13,15 @@ import (
 	gopsutil_process "github.com/shirou/gopsutil/v3/process"
 )
 
+// ChmodRestrictFile sets the appropriate permissions on a file so it can not be read by everyone
+// On POSIX this is a normal chmod call.
+func ChmodRestrictFile(path string) error {
+	if err := os.Chmod(path, constant.DefaultFileMode); err != nil {
+		return fmt.Errorf("chmod restrict file: %w", err)
+	}
+	return nil
+}
+
 // ChmodExecutableDirectory sets the appropriate permissions on an executable
 // file. On POSIX this is a normal chmod call.
 func ChmodExecutableDirectory(path string) error {
diff --git a/orbit/pkg/platform/platform_windows.go b/orbit/pkg/platform/platform_windows.go
index 7bd03f61e8..1253a60839 100644
--- a/orbit/pkg/platform/platform_windows.go
+++ b/orbit/pkg/platform/platform_windows.go
@@ -25,6 +25,23 @@ const (
 	readAndExecute = uint32(131241)
 )
 
+// ChmodRestrictFile sets the appropriate permissions on a file so it can not be read by everyone
+// On POSIX this is a normal chmod call.
+func ChmodRestrictFile(path string) error {
+	if err := acl.Apply(
+		path,
+		true,
+		false,
+		acl.GrantSid(windows.GENERIC_ALL, constant.SystemSID),
+		acl.GrantSid(windows.GENERIC_ALL, constant.AdminSID),
+		acl.GrantSid(0, constant.UserSID), // no access permissions for regular users
+	); err != nil {
+		return fmt.Errorf("restricting file access: %w", err)
+	}
+
+	return nil
+}
+
 // ChmodExecutableDirectory sets the appropriate permissions on the parent
 // directory of an executable file. On Windows this involves setting the
 // appropriate ACLs.
diff --git a/server/service/orbit_client.go b/server/service/orbit_client.go
index 2e650136e7..7a352e8b2c 100644
--- a/server/service/orbit_client.go
+++ b/server/service/orbit_client.go
@@ -10,10 +10,12 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"runtime"
 	"sync"
 	"time"
 
 	"github.com/fleetdm/fleet/v4/orbit/pkg/constant"
+	"github.com/fleetdm/fleet/v4/orbit/pkg/platform"
 	"github.com/fleetdm/fleet/v4/pkg/retry"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/rs/zerolog/log"
@@ -200,9 +202,25 @@ func (oc *OrbitClient) enrollAndWriteNodeKeyFile() (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("enroll request: %w", err)
 	}
+
+	if runtime.GOOS == "windows" {
+
+		// creating the secret file with empty content
+		if err := os.WriteFile(oc.nodeKeyFilePath, nil, constant.DefaultFileMode); err != nil {
+			return "", fmt.Errorf("create orbit node key file: %w", err)
+		}
+
+		// restricting file access
+		if err := platform.ChmodRestrictFile(oc.nodeKeyFilePath); err != nil {
+			return "", fmt.Errorf("apply ACLs: %w", err)
+		}
+	}
+
+	// writing raw key material to the acl-ready secret file
 	if err := os.WriteFile(oc.nodeKeyFilePath, []byte(orbitNodeKey), constant.DefaultFileMode); err != nil {
 		return "", fmt.Errorf("write orbit node key file: %w", err)
 	}
+
 	return orbitNodeKey, nil
 }