[LOW] Directory and File Permissions Should Be More Restrictive

[MacJediWizard]

Description

Several files and directories are created with permissions that could be more restrictive.

Locations

Directory creation with 0755

• `cmd/patchmon-agent/commands/root.go` line 90
• `internal/config/config.go` line 254
• `cmd/patchmon-agent/commands/version_update.go` lines 527, 562, 612

_ = os.MkdirAll(filepath.Dir(logFile), 0755)

Crontab file with 0644

`internal/crontab/crontab.go` line 47

if err := os.WriteFile(config.CronFilePath, []byte(content), 0644); err != nil {

Backup files with 0755

`cmd/patchmon-agent/commands/version_update.go` line 433

return os.WriteFile(dst, data, 0755)

Note: Good Practice Found

Credentials file correctly uses 0600:
`internal/config/config.go` lines 165-167

if err := os.Chmod(m.config.CredentialsFile, 0600); err != nil {
    return fmt.Errorf("error setting credentials file permissions: %w", err)
}

Recommended Fix

1. Use more restrictive permissions for sensitive directories:

// For /etc/patchmon/
_ = os.MkdirAll(filepath.Dir(logFile), 0750)  // Group read/execute only

2. For crontab, check minimum required permissions for cron daemon

3. For backup files:

return os.WriteFile(dst, data, 0700)  // Owner only

Severity

🟢 LOW - Defense in depth

Labels

security, low

[MacJediWizard]

Fixed: Updated directory and file permissions to be more restrictive.

Changes made:

1. config.go - setupDirectories(): Changed from 0755 to 0750

   • Config, credentials, and log directories now have no world access

2. root.go - log directory: Changed from 0755 to 0750

   • Log directory now has no world access

3. version_update.go - backup files: Changed from 0755 to 0700

   • Backup files are now owner-only accessible

4. version_update.go - markRecentUpdate(): Changed from 0755 to 0700

   • /etc/patchmon directory uses restrictive permissions

Already fixed in previous commits:

• Helper script files now use 0700 (issue [HIGH] Shell Scripts Generated and Executed at Runtime #3)
• /etc/patchmon directory in restart helpers now uses 0700 (issue [HIGH] Shell Scripts Generated and Executed at Runtime #3)

Permission summary:

• Directories: 0750 (owner: rwx, group: r-x, world: ---)
• Sensitive directories (/etc/patchmon): 0700 (owner only)
• Backup files: 0700 (owner only)
• Credentials file: 0600 (already correct)

Note: Crontab file remains at 0644 as it needs to be readable by the cron daemon.