Use restrictive permissions (0700) for cache directories#714
Merged
Use restrictive permissions (0700) for cache directories#714
Conversation
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
kommendorkapten
approved these changes
Jan 21, 2026
thaJeztah
reviewed
Feb 2, 2026
Comment on lines
-87
to
+92
| if err := os.MkdirAll(path, os.ModePerm); err != nil { | ||
| // Use 0700 for cache directories: only the owner can read, write, and | ||
| // access the directory. This prevents other users on shared systems from | ||
| // reading or writing to the TUF cache, which could be a security risk. | ||
| // If different permissions are needed, pre-create the directories with | ||
| // the desired permissions before calling this function. | ||
| if err := os.MkdirAll(path, 0700); err != nil { |
There was a problem hiding this comment.
I noticed this patch when updating our dependencies; not sure how important, but note that os.MkDirAll only creates missing directories, and ignores existing ones, and won't fix ownership (if anything else);
https://go.dev/play/p/6qrYT_RVhaL
package main
import (
"os"
"path/filepath"
"syscall"
"testing"
)
func TestPerms(t *testing.T) {
tmpDir := t.TempDir()
cacheDir := filepath.Join(tmpDir, "foo", "cache")
err := os.MkdirAll(cacheDir, 0o755)
if err != nil {
t.Fatal(err)
}
// Chown requires root
if os.Getuid() == 0 {
err = os.Chown(cacheDir, 123, 456)
if err != nil {
t.Fatal(err)
}
}
printMode(t, cacheDir)
err = os.MkdirAll(cacheDir, 0o700)
if err != nil {
t.Fatal(err)
}
printMode(t, cacheDir)
err = os.Chmod(cacheDir, 0o700)
if err != nil {
t.Fatal(err)
}
printMode(t, cacheDir)
}
func printMode(t *testing.T, path string) {
t.Helper()
fi, err := os.Stat(path)
if err != nil {
t.Fatal(err)
}
var uid, gid uint32
if stat, ok := fi.Sys().(*syscall.Stat_t); ok && stat != nil {
uid = stat.Uid
gid = stat.Gid
}
t.Logf("fileMode: %s, (uid=%d, gid=%d)", fi.Mode().String(), uid, gid)
}
Member
There was a problem hiding this comment.
Yeah, that's stated in the comment (this permission mode only applies if new directories are created):
// If different permissions are needed, pre-create the directories with // the desired permissions before calling this function.
There was a problem hiding this comment.
🤦 Doh! I read it wrong, and thought that was describing what the code tried to achieve.
I saw the change and thought "right, but this won't fix if it's there!" 😅
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The following PR updates the permissions used for cache directories