From 2b7916e08ffac9883000aed6fc6757c17e913c94 Mon Sep 17 00:00:00 2001
From: Claudio Costa <cstcld91@gmail.com>
Date: Fri, 13 Dec 2019 19:53:42 +0100
Subject: [PATCH] [MM-21119] Update config files permissions (#13386)

* Update config files permissions

* Add error check

* Update permissions for persist
---
 config/file.go      | 4 ++--
 config/file_test.go | 8 ++++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/config/file.go b/config/file.go
index fceea8016c..7ef396ce58 100644
--- a/config/file.go
+++ b/config/file.go
@@ -122,7 +122,7 @@ func (fs *FileStore) persist(cfg *model.Config) error {
 		return errors.Wrap(err, "failed to serialize")
 	}
 
-	err = ioutil.WriteFile(fs.path, b, 0644)
+	err = ioutil.WriteFile(fs.path, b, 0600)
 	if err != nil {
 		return errors.Wrap(err, "failed to write file")
 	}
@@ -184,7 +184,7 @@ func (fs *FileStore) GetFile(name string) ([]byte, error) {
 func (fs *FileStore) SetFile(name string, data []byte) error {
 	resolvedPath := fs.resolveFilePath(name)
 
-	err := ioutil.WriteFile(resolvedPath, data, 0777)
+	err := ioutil.WriteFile(resolvedPath, data, 0600)
 	if err != nil {
 		return errors.Wrapf(err, "failed to write file to %s", resolvedPath)
 	}
diff --git a/config/file_test.go b/config/file_test.go
index 048c3aa320..a7e4e3162c 100644
--- a/config/file_test.go
+++ b/config/file_test.go
@@ -924,6 +924,14 @@ func TestFileSetFile(t *testing.T) {
 		require.Equal(t, []byte("new file"), data)
 	})
 
+	t.Run("should set right permissions", func(t *testing.T) {
+		absolutePath := filepath.Join(filepath.Dir(path), "new")
+		err := fs.SetFile(absolutePath, []byte("data"))
+		require.NoError(t, err)
+		fi, err := os.Stat(absolutePath)
+		require.NoError(t, err)
+		require.Equal(t, os.FileMode(0600), fi.Mode().Perm())
+	})
 }
 
 func TestFileHasFile(t *testing.T) {