Skip to content

vault-agent file sink mode is parsed incorrectly #9404

@petracvv

Description

@petracvv

Describe the bug
When running vault-agent auto-auth and using the file sink method, the mode option does not work as expected. Permissions are octal (base-8) but the mode field in the configuration for the file sink is parsed as an integer (base-10). This leads to a lot of confusion and unexpected behavior with permissions for the sink file that is created.

I suggest the mode field be parsed as a JSON string instead of a JSON integer and validation about it being a valid octal permission be done afterwards.

To Reproduce

  1. Install vault agent with an auto-auth configuration as follows:
{
   "pid_file": "./pidfile",
   "exit_after_auth": false,
   "vault": {
     "address": "https://<vault-address-here>:8200"
   },
   "auto_auth": {
     "method": {
       "type": "approle",
       "config": {
         "role_id_file_path": "/tmp/.roleid",
         "secret_id_file_path": "/tmp/.secretid",
       }
   },
 "sink": [
   {
     "type": "file",
     "config": {
       "path": "/tmp/.vault-token",
       "mode": 640
     }
   }
 ]
}

Provide an approle role_id and secret_id at the appropriate locations

  1. Start the vault-agent service.
  2. Look at the permissions for the /tmp/.vault-token file and see that they are incorrect
[root@75856f20-e289-4 ~]# stat -c "%a" /tmp/.vault-token 
200

640 base-10 is 1200 in octal which when applied to a file results in 200 unix permissions.

If I enter the base-10 equivalent of the 640 octal number which is 416 into the configuration, I get the expected unix file permissions.

Expected behavior
I expected the permissions of the file-sink file to be the octal mode I entered in the configuration.

Environment:

  • Vault Server Version: 1.3.2 (the one the agent is connecting to)
  • Vault Agent Version: 1.4.2
  • Server Operating System/Architecture: RHEL7

Metadata

Metadata

Assignees

No one assigned

    Labels

    agentbugUsed to indicate a potential bug

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions