saltstack/salt — pull request #482 by iamb (2012-01-11 02:48:30+00:00)
Title: Protect cache files

Found a rather important issue I'd consider a bug...cache files and dirs are created with current umask, which is usually going to mean world-readable. Users may be surprised to find a managed file with restrictive ownership/modes is also contained in a world-accessible cache dir. I know I was. :)

This patch indtroduces a few changes:

in salt/__init__.py in the verify_env function which creates cache dir, the pki dirs, the jobs dir, log file, socket dir...set a restrictive umask and chmod. None of these need to be accessible to anyone but the user as which minion runs (always root as of now).

in salt/minion.py when retreiving files to the cache, use restrictive umask/chmod. should be controlled by the restrictive cache dir permissions, but this doesnt hurt and was minimal code. I didn't touch directory creation as that would have been a fair amount more code for little benefit.

in salt/states/file.py use shutil.copyfile() over shutil.copy(). This will keep current behavior in that files will be created with default umask when copied over, and then managed the same as before by the mode: setting.