Improve permissions on crontabs created by rockstor #2559
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #2556
@phillxnet, @Hooverdan96, ready for review.
We currently do not enforce any specific permissions on the crontabs generated by Rockstor. This can lead to some instances where these are set with a mask of
644
, for instance.This pull request (PR) proposes to enforce a more restrictive mask of
600
at creation of these crontabs.Note that this PR also proposes to slightly change the logic used for the creation of these files. Indeed, we currently edit/write the file "in-place", at its final destination (for instance,
/etc/cron.d/rockstortab
). In this PR, we use of potentially safer yet slightly slower (just a couple more calls) process akin to what is used more widely throughout the project:/etc/cron.d/rockstortab
for instance)Demonstration
Tests
On a Leap 15.4 VM: