Repository: spotify/luigi
Issue category: Security Vulnerability

Issue:
Overly permissive file permissions in `luigi/lock.py`
Hi,

I am reporting a potential security with overly permissive file permissions in

https://github.com/spotify/luigi/blob/master/luigi/lock.py#L103

When creating a file, POSIX systems allow permissions to be specified for the owner, group, and others separately. Permissions should be kept as strict as possible, preventing other users from accessing the file's contents. Additionally, they can be used to write and execute malicious code for privileged escalation.

## References
- Wikipedia: [File system permissions](https://en.wikipedia.org/wiki/File_system_permissions)
- Common Weakness Enumeration: [CWE-732](https://cwe.mitre.org/data/definitions/732.html)


Hints:

Patch:
diff --git a/luigi/lock.py b/luigi/lock.py
index dfa5acbcdb..5a9e1f8014 100644
--- a/luigi/lock.py
+++ b/luigi/lock.py
@@ -100,7 +100,7 @@ def acquire_for(pid_dir, num_available=1, kill_signal=None):
     # Create a pid file if it does not exist
     try:
         os.mkdir(pid_dir)
-        os.chmod(pid_dir, 0o777)
+        os.chmod(pid_dir, 0o700)
     except OSError as exc:
         if exc.errno != errno.EEXIST:
             raise


Test patch:
diff --git a/test/lock_test.py b/test/lock_test.py
index 2701bd963f..b04726066e 100644
--- a/test/lock_test.py
+++ b/test/lock_test.py
@@ -100,7 +100,7 @@ def test_acquiring_partially_taken_lock(self):
         self.assertTrue(acquired)
 
         s = os.stat(self.pid_file)
-        self.assertEqual(s.st_mode & 0o777, 0o777)
+        self.assertEqual(s.st_mode & 0o700, 0o700)
 
     def test_acquiring_lock_from_missing_process(self):
         fake_pid = 99999
@@ -111,7 +111,7 @@ def test_acquiring_lock_from_missing_process(self):
         self.assertTrue(acquired)
 
         s = os.stat(self.pid_file)
-        self.assertEqual(s.st_mode & 0o777, 0o777)
+        self.assertEqual(s.st_mode & 0o700, 0o700)
 
     @mock.patch('os.kill')
     def test_take_lock_with_kill(self, kill_fn):