primal/athens
1
0
Fork 0
mirror of https://github.com/gomods/athens synced 2026-02-03 11:00:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

File permissions on config files allow more restrictive setting (#966)

Browse Source 
* File permissions on config files allow more restrictive setting

* Make the tests a bit more readable

* Bring back the tests dude

* Update error message

* remove else

* Add more test cases

* Change Lstat to Stat

* Add note for umask

* Make sure the permissions are 0600 or lower

* Update config file

* Do not check for windows

* Fix CI errors

* Fix CI test
This commit is contained in:
Manu Gupta
2018-12-18 07:26:04 -08:00
committed by marpio
parent aee30a4209
commit 5eba6f2e47
6 changed files with 91 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/config/config.go
+8 -11
View File
@@ -89,7 +89,7 @@ func ParseConfigFile(configFile string) (*Config, error) {
}
// Check file perms from config
if err := checkFilePerms(config.FilterFile); err != nil {
if err := checkFilePerms(configFile, config.FilterFile); err != nil {
return nil, err
}
@@ -162,21 +162,18 @@ func checkFilePerms(files ...string) error {
// TODO: Do not ignore errors when a file is not found
// There is a subtle bug in the filter module which ignores the filter file if it does not find it.
// This check can be removed once that has been fixed
fInfo, err := os.Lstat(f)
fInfo, err := os.Stat(f)
if err != nil {
continue
}
if runtime.GOOS == "windows" {
if (fInfo.Mode() & 0600) != 0600 {
return errors.E(op, f+" should have 0600 as permission")
}
} else {
// Assume unix based system (MacOS and Linux)
if fInfo.Mode() != 0640 {
return errors.E(op, f+" should have 0640 as permission")
}
// Assume unix based system (MacOS and Linux)
// the bit mask is calculated using the umask command which tells which permissions
// should not be allowed for a particular user, group or world
if fInfo.Mode()&0077 != 0 && runtime.GOOS != "windows" {
return errors.E(op, f+" should have at most rwx,-, - (bit mask 077) as permission")
}
}
return nil