Linter: gosec, Rule: G306 - Poor file permissions used when writing to a new file. Should we enable it?

[zak-pawel]

Use Case

This issue starts discussion about enabling:

• linter: gosec - Inspects source code for security problems by scanning the Go AST.
• rule: G306 - Poor file permissions used when writing to a new file

Rule is mapped to CWE-276: Incorrect Default Permissions.

Expected behavior

Decision if rule should be enabled or not.

Actual behavior

For this rule following findings were found in current code:

internal/rotate/file_writer_test.go:47:9                              gosec  G306: Expect WriteFile permissions to be 0600 or less
internal/rotate/file_writer_test.go:77:9                              gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/bcache/bcache_test.go:51:8                             gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/bcache/bcache_test.go:55:8                             gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/bcache/bcache_test.go:59:8                             gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/bcache/bcache_test.go:63:8                             gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/bcache/bcache_test.go:67:8                             gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/bcache/bcache_test.go:71:8                             gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/bcache/bcache_test.go:75:8                             gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/bcache/bcache_test.go:79:8                             gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/bcache/bcache_test.go:83:8                             gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/ceph/ceph_test.go:195:10                               gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/conntrack/conntrack_test.go:53:21                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/conntrack/conntrack_test.go:83:21                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/conntrack/conntrack_test.go:84:21                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/directory_monitor/directory_monitor_test.go:80:8       gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/directory_monitor/directory_monitor_test.go:151:8      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:46:21                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:47:21                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:48:21                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:51:21                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:52:21                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:53:21                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:94:21                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:95:21                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:96:21                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:120:21                     gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:121:21                     gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:122:21                     gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:156:21                     gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:157:21                     gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_cpu/linux_cpu_test.go:158:21                     gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_sysctl_fs/linux_sysctl_fs_test.go:14:21          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_sysctl_fs/linux_sysctl_fs_test.go:15:21          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_sysctl_fs/linux_sysctl_fs_test.go:16:21          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_sysctl_fs/linux_sysctl_fs_test.go:17:21          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_sysctl_fs/linux_sysctl_fs_test.go:18:21          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/linux_sysctl_fs/linux_sysctl_fs_test.go:19:21          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/logparser/logparser_test.go:144:8                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/lustre2/lustre2_test.go:150:8                          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/lustre2/lustre2_test.go:153:8                          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/lustre2/lustre2_test.go:156:8                          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/lustre2/lustre2_test.go:218:8                          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/lustre2/lustre2_test.go:221:8                          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/lustre2/lustre2_test.go:282:8                          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/lustre2/lustre2_test.go:285:8                          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/passenger/passenger_test.go:29:12                      gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/postfix/postfix_test.go:22:21                          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/postfix/postfix_test.go:23:21                          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/postfix/postfix_test.go:24:21                          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/postfix/postfix_test.go:25:21                          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/postfix/postfix_test.go:26:21                          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/postfix/postfix_test.go:27:21                          gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/procstat/procstat_test.go:388:9                        gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/zfs/zfs_linux_test.go:204:8                            gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/zfs/zfs_linux_test.go:207:8                            gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/zfs/zfs_linux_test.go:232:8                            gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/zfs/zfs_linux_test.go:256:8                            gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/zfs/zfs_linux_test.go:259:8                            gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/zfs/zfs_linux_test.go:262:8                            gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/zfs/zfs_linux_test.go:265:8                            gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/zfs/zfs_linux_test.go:268:8                            gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/zfs/zfs_linux_test.go:271:8                            gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/zfs/zfs_linux_test.go:274:8                            gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/zfs/zfs_linux_test.go:297:8                            gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/zipkin/cmd/thrift_serialize/thrift_serialize.go:65:13  gosec  G306: Expect WriteFile permissions to be 0600 or less
plugins/inputs/zipkin/cmd/thrift_serialize/thrift_serialize.go:73:13  gosec  G306: Expect WriteFile permissions to be 0600 or less
tools/update_goversion/main.go:32:8                                   gosec  G306: Expect WriteFile permissions to be 0600 or less

Additional info

For this rule additional configuration can be provided:

      # Maximum allowed permissions mode for os.WriteFile and ioutil.WriteFile
      # Default: "0600"
      G306: "0600"

[powersj]

What do you get with 640, which seems like a more sane default maybe?

[zak-pawel]

I agree that 640 seems to be more sane, but list of findings is exactly the same :)

[powersj]

+1 with 640

[srebhan]

0640 is the way to go.