Language: Python
Label: safe
CWE: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Code:
    def test_existing_file_permissions(self, init, tmpdir):
        """Test file permissions are set as expected.

        CIS Hardening requires 640 permissions. These permissions are
        currently hardcoded on every boot, but if there's ever a reason
        to change this, we need to then ensure that they
        are *not* set every boot.

        See https://bugs.launchpad.net/cloud-init/+bug/1900837.
        """
        log_file = tmpdir.join("cloud-init.log")
        log_file.ensure()
        # Use a mode that will never be made the default so this test will
        # always be valid
        log_file.chmod(0o606)
        init._cfg = {"def_log_file": str(log_file)}

        init._initialize_filesystem()

        assert 0o640 == stat.S_IMODE(log_file.stat().mode)