Linter: gosec, Rule: G302 - Poor file permissions used with chmod. Should we enable it?

[zak-pawel]

Use Case

This issue starts discussion about enabling:

• linter: gosec - Inspects source code for security problems by scanning the Go AST.
• rule: G302 - Poor file permissions used with chmod

Rule is mapped to CWE-276: Incorrect Default Permissions.

Expected behavior

Decision if rule should be enabled or not.

Actual behavior

For this rule no findings were found in current code.

Additional info

For this rule additional configuration can be provided:

      # Maximum allowed permissions mode for os.OpenFile and os.Chmod
      # Default: "0600"
      G302: "0600"

[zak-pawel]

With exclude-use-default: false set in .golangci.yml following findings were found for this rule:

cmd/telegraf/telegraf.go:337:13  gosec  G302: Expect file permissions to be 0600 or less
logger/logger_test.go:96:15      gosec  G302: Expect file permissions to be 0600 or less

Currently they are excluded by default by:

# EXC0009 gosec: Too many issues in popular repos
- (Expect directory permissions to be 0750 or less|Expect file permissions to be 0600 or less)

[powersj]

+1 but we should talk about 640 vs 600

[zak-pawel]

640 seems better (but list of findings is the same)

[srebhan]

0640 is good.