Fix permissions for resolv.conf and hosts

WriteFile sets permissions before umask is applied. For people using agressive umasks (0077), /etc/resolv.conf will end-up unreadable for non root processes. See #3704 Signed-off-by: apostasie <[email protected]>
containerd · Dec 2, 2024 · f02707c · f02707c
1 parent 3c41efe
commit f02707c
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/pkg/dnsutil/hostsstore/hostsstore.go b/pkg/dnsutil/hostsstore/hostsstore.go
@@ -114,6 +114,9 @@ func (x *hostsStore) Acquire(meta Meta) (err error) {
 		if err = os.WriteFile(loc, []byte{}, 0o644); err != nil {
 			return errors.Join(store.ErrSystemFailure, err)
 		}
+		if err = os.Chmod(loc, 0o644); err != nil {
+			err = errors.Join(store.ErrSystemFailure, err)
+		}
 
 		var content []byte
 		content, err = json.Marshal(meta)
@@ -175,6 +178,9 @@ func (x *hostsStore) AllocHostsFile(id string, content []byte) (location string,
 		if err != nil {
 			err = errors.Join(store.ErrSystemFailure, err)
 		}
+		if err = os.Chmod(loc, 0o644); err != nil {
+			err = errors.Join(store.ErrSystemFailure, err)
+		}
 
 		return err
 	})
@@ -333,6 +339,7 @@ func (x *hostsStore) updateAllHosts() (err error) {
 		if err != nil {
 			log.L.WithError(err).Errorf("failed to write hosts file for %q", entry)
 		}
+		_ = os.Chmod(loc, 0o644)
 	}
 	return nil
 }
diff --git a/pkg/resolvconf/resolvconf.go b/pkg/resolvconf/resolvconf.go
@@ -317,7 +317,12 @@ func Build(path string, dns, dnsSearch, dnsOptions []string) (*File, error) {
 		return nil, err
 	}
 
-	return &File{Content: content.Bytes(), Hash: hash}, os.WriteFile(path, content.Bytes(), 0644)
+	err = os.WriteFile(path, content.Bytes(), 0o644)
+	if err != nil {
+		return nil, err
+	}
+
+	return &File{Content: content.Bytes(), Hash: hash}, os.Chmod(path, 0o644)
 }
 
 func hashData(src io.Reader) (string, error) {