Use restrictive permissions (0700) for cache directories

[rdimitrov]

The following PR updates the permissions used for cache directories

[thaJeztah]

I noticed this patch when updating our dependencies; not sure how important, but note that os.MkDirAll only creates missing directories, and ignores existing ones, and won't fix ownership (if anything else);

https://go.dev/play/p/6qrYT_RVhaL

package main

import (
	"os"
	"path/filepath"
	"syscall"
	"testing"
)

func TestPerms(t *testing.T) {
	tmpDir := t.TempDir()

	cacheDir := filepath.Join(tmpDir, "foo", "cache")
	err := os.MkdirAll(cacheDir, 0o755)
	if err != nil {
		t.Fatal(err)
	}

	// Chown requires root
	if os.Getuid() == 0 {
		err = os.Chown(cacheDir, 123, 456)
		if err != nil {
			t.Fatal(err)
		}
	}
	printMode(t, cacheDir)

	err = os.MkdirAll(cacheDir, 0o700)
	if err != nil {
		t.Fatal(err)
	}
	printMode(t, cacheDir)

	err = os.Chmod(cacheDir, 0o700)
	if err != nil {
		t.Fatal(err)
	}
	printMode(t, cacheDir)
}

func printMode(t *testing.T, path string) {
	t.Helper()
	fi, err := os.Stat(path)
	if err != nil {
		t.Fatal(err)
	}
	var uid, gid uint32
	if stat, ok := fi.Sys().(*syscall.Stat_t); ok && stat != nil {
		uid = stat.Uid
		gid = stat.Gid
	}

	t.Logf("fileMode: %s, (uid=%d, gid=%d)", fi.Mode().String(), uid, gid)
}

[kommendorkapten]

Yeah, that's stated in the comment (this permission mode only applies if new directories are created):

  // If different permissions are needed, pre-create the directories with
  // the desired permissions before calling this function.

[thaJeztah]

🤦 Doh! I read it wrong, and thought that was describing what the code tried to achieve.

I saw the change and thought "right, but this won't fix if it's there!" 😅