fix: use 0644 permissions for runtime data files in .func/#3867
Conversation
Changed file permission mode from os.ModePerm to 0644 for files written in the Stamp and WriteRuntimeBuiltImage functions to ensure proper access control.
knative-prow
Bot
added
size/XS
|
Hi @Ankitsinghsisodya. Thanks for your PR. I'm waiting for a knative member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
This PR tightens the permissions used when writing function build metadata files, avoiding overly permissive file modes.
Changes:
- Change
os.WriteFilepermissions fromos.ModePerm(0777) to0644when writing the built hash. - Change
os.WriteFilepermissions fromos.ModePerm(0777) to0644when writing the built image reference.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| // Write out the hash | ||
| if err = os.WriteFile(filepath.Join(f.Root, RunDataDir, BuiltHash), []byte(hash), os.ModePerm); err != nil { | ||
| if err = os.WriteFile(filepath.Join(f.Root, RunDataDir, BuiltHash), []byte(hash), 0644); err != nil { |
| } | ||
|
|
||
| return os.WriteFile(path, []byte(f.Build.Image), os.ModePerm) | ||
| return os.WriteFile(path, []byte(f.Build.Image), 0644) |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3867 +/- ##
==========================================
- Coverage 53.40% 53.39% -0.02%
==========================================
Files 200 200
Lines 23413 23413
==========================================
- Hits 12504 12501 -3
- Misses 9659 9661 +2
- Partials 1250 1251 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Ankitsinghsisodya, matejvasek The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
knative-prow
Bot
added
the
approved
|
/ok-to-test |
knative-prow
Bot
added
ok-to-test
Problem
.func/built-imageand.func/built-hashwere written usingos.ModePerm(
0777), which sets the execute bit on plain data files and is inconsistentwith the rest of the codebase.
The
pkg/configpackage already writes~/.func/config.yamlwith explicit0600permissions and has a dedicated test enforcing this. The runtime datadirectory had no such discipline.
Changes
pkg/functions/function.go:577—BuiltHashfile now written with0644pkg/functions/function.go:833—BuiltImagefile now written with0644client.go:1277(MkdirAllfor the.func/directory) is intentionallyunchanged — using
os.ModePermwithMkdirAllis standard Go practice fordirectories; the umask produces the correct
0755result.Why 0644 and not 0600
These files contain build metadata (image references, content hashes), not
credentials. They do not need to be private to the owner.
0644gives theowner read/write and others read-only, with no execute bits — appropriate for
data files.
Testing
make testpasses with no changes to existing tests