fix(review): tighten init trace file permissions
- commit
- c4642325d2c594d96300c1020ca3f8fcbdf7b6a8
- author
- brice · · 2026-04-19 10:21 UTC
- parent
- 62cb26b
- signature
- GPG Verified
CD88F9E564E0102646FB6077A1A07C7C7C3E349D· arch-gpg Verified for the committer email
2 files · +8 -1
M internal/infrastructure/cef/engine_init.go +3 -0
| @@ -494,6 +494,9 @@ func prepareCEFInitTraceFile(defaultLogFile, logFile string) (string, error) { | |||
| 494 | 494 | if err := file.Truncate(0); err != nil { | |
| 495 | 495 | return "", fmt.Errorf("reset %s: %w", bootstrapLogFile, err) | |
| 496 | 496 | } | |
| 497 | + | if err := file.Chmod(filePerm); err != nil { | |
| 498 | + | return "", fmt.Errorf("chmod %s: %w", bootstrapLogFile, err) | |
| 499 | + | } | |
| 497 | 500 | return bootstrapLogFile, nil | |
| 498 | 501 | } | |
| 499 | 502 | ||
| @@ -494,6 +494,9 @@ func prepareCEFInitTraceFile(defaultLogFile, logFile string) (string, error) { | |||||
| 494 | if err := file.Truncate(0); err != nil { | 494 | if err := file.Truncate(0); err != nil { | ||
| 495 | return "", fmt.Errorf("reset %s: %w", bootstrapLogFile, err) | 495 | return "", fmt.Errorf("reset %s: %w", bootstrapLogFile, err) | ||
| 496 | } | 496 | } | ||
| 497 | + | if err := file.Chmod(filePerm); err != nil { | |||
| 498 | + | return "", fmt.Errorf("chmod %s: %w", bootstrapLogFile, err) | |||
| 499 | + | } | |||
| 497 | return bootstrapLogFile, nil | 500 | return bootstrapLogFile, nil | ||
| 498 | } | 501 | } | ||
| 499 | 502 | ||||
M internal/infrastructure/cef/engine_init_test.go +5 -1
| @@ -147,7 +147,7 @@ func TestPrepareCEFInitTraceFile_TruncatesExistingFile(t *testing.T) { | |||
| 147 | 147 | logFile := filepath.Join(t.TempDir(), "custom", "cef_runtime.log") | |
| 148 | 148 | bootstrapLogFile := filepath.Join(filepath.Dir(logFile), "cef_runtime.bootstrap.log") | |
| 149 | 149 | require.NoError(t, os.MkdirAll(filepath.Dir(bootstrapLogFile), dirPerm)) | |
| 150 | - | require.NoError(t, os.WriteFile(bootstrapLogFile, []byte("existing"), filePerm)) | |
| 150 | + | require.NoError(t, os.WriteFile(bootstrapLogFile, []byte("existing"), 0o644)) | |
| 151 | 151 | ||
| 152 | 152 | path, err := prepareCEFInitTraceFile("", logFile) | |
| 153 | 153 | require.NoError(t, err) | |
| @@ -156,6 +156,10 @@ func TestPrepareCEFInitTraceFile_TruncatesExistingFile(t *testing.T) { | |||
| 156 | 156 | content, readErr := os.ReadFile(path) | |
| 157 | 157 | require.NoError(t, readErr) | |
| 158 | 158 | require.Empty(t, content) | |
| 159 | + | ||
| 160 | + | info, statErr := os.Stat(path) | |
| 161 | + | require.NoError(t, statErr) | |
| 162 | + | require.Equal(t, os.FileMode(filePerm), info.Mode().Perm()) | |
| 159 | 163 | } | |
| 160 | 164 | ||
| 161 | 165 | func TestPrepareCEFInitTraceFile_RejectsSymlink(t *testing.T) { | |
| @@ -147,7 +147,7 @@ func TestPrepareCEFInitTraceFile_TruncatesExistingFile(t *testing.T) { | |||||
| 147 | logFile := filepath.Join(t.TempDir(), "custom", "cef_runtime.log") | 147 | logFile := filepath.Join(t.TempDir(), "custom", "cef_runtime.log") | ||
| 148 | bootstrapLogFile := filepath.Join(filepath.Dir(logFile), "cef_runtime.bootstrap.log") | 148 | bootstrapLogFile := filepath.Join(filepath.Dir(logFile), "cef_runtime.bootstrap.log") | ||
| 149 | require.NoError(t, os.MkdirAll(filepath.Dir(bootstrapLogFile), dirPerm)) | 149 | require.NoError(t, os.MkdirAll(filepath.Dir(bootstrapLogFile), dirPerm)) | ||
| 150 | - | require.NoError(t, os.WriteFile(bootstrapLogFile, []byte("existing"), filePerm)) | 150 | + | require.NoError(t, os.WriteFile(bootstrapLogFile, []byte("existing"), 0o644)) |
| 151 | 151 | ||||
| 152 | path, err := prepareCEFInitTraceFile("", logFile) | 152 | path, err := prepareCEFInitTraceFile("", logFile) | ||
| 153 | require.NoError(t, err) | 153 | require.NoError(t, err) | ||
| @@ -156,6 +156,10 @@ func TestPrepareCEFInitTraceFile_TruncatesExistingFile(t *testing.T) { | |||||
| 156 | content, readErr := os.ReadFile(path) | 156 | content, readErr := os.ReadFile(path) | ||
| 157 | require.NoError(t, readErr) | 157 | require.NoError(t, readErr) | ||
| 158 | require.Empty(t, content) | 158 | require.Empty(t, content) | ||
| 159 | + | ||||
| 160 | + | info, statErr := os.Stat(path) | |||
| 161 | + | require.NoError(t, statErr) | |||
| 162 | + | require.Equal(t, os.FileMode(filePerm), info.Mode().Perm()) | |||
| 159 | } | 163 | } | ||
| 160 | 164 | ||||
| 161 | func TestPrepareCEFInitTraceFile_RejectsSymlink(t *testing.T) { | 165 | func TestPrepareCEFInitTraceFile_RejectsSymlink(t *testing.T) { | ||