From 33ccedc66fc30523f11d480d9d32f33c059fab7d Mon Sep 17 00:00:00 2001 From: Riccardo Ravaioli Date: Mon, 2 Oct 2023 11:46:27 +0200 Subject: [PATCH] Create IPAM files with 0600 permissions Conform to CIS Benchmarks "1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive" https://www.tenable.com/audits/items/CIS_Kubernetes_v1.20_v1.0.1_Level_1_Master.audit:f1717a5dd65d498074dd41c4a639e47d Signed-off-by: Riccardo Ravaioli --- plugins/ipam/host-local/backend/disk/backend.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/ipam/host-local/backend/disk/backend.go b/plugins/ipam/host-local/backend/disk/backend.go index 344f147fa..3ad19d99d 100644 --- a/plugins/ipam/host-local/backend/disk/backend.go +++ b/plugins/ipam/host-local/backend/disk/backend.go @@ -60,7 +60,7 @@ func New(network, dataDir string) (*Store, error) { func (s *Store) Reserve(id string, ifname string, ip net.IP, rangeID string) (bool, error) { fname := GetEscapedPath(s.dataDir, ip.String()) - f, err := os.OpenFile(fname, os.O_RDWR|os.O_EXCL|os.O_CREATE, 0o644) + f, err := os.OpenFile(fname, os.O_RDWR|os.O_EXCL|os.O_CREATE, 0o600) if os.IsExist(err) { return false, nil } @@ -78,7 +78,7 @@ func (s *Store) Reserve(id string, ifname string, ip net.IP, rangeID string) (bo } // store the reserved ip in lastIPFile ipfile := GetEscapedPath(s.dataDir, lastIPFilePrefix+rangeID) - err = os.WriteFile(ipfile, []byte(ip.String()), 0o644) + err = os.WriteFile(ipfile, []byte(ip.String()), 0o600) if err != nil { return false, err }