Set job log tempfile permissions to 644 (was 600) #3330
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
DrJosh9000
approved these changes
Jun 3, 2025
catkins
reviewed
Jun 3, 2025
| @@ -265,6 +265,12 @@ func NewJobRunner(ctx context.Context, l logger.Logger, apiClient APIClient, con | |||
| if err != nil { | |||
| return nil, err | |||
| } | |||
|
|
|||
There was a problem hiding this comment.
os.CreateTemp ah cool, I see in the godocs the default perms
The file is created with mode 0o600 (before umask)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Currently, when users use the
--job-log-tempfileflag on the agent, the tempfile is created with600permissions (ie, readable and writable by the current user, unavailable to everyone else). This can be frustrating, as a primary use case for this file is ingestion by a log ingestion framework a la Cloudwatch/Stackdriver/Loki, which often run as different users.To fix this, this PR sets the permissions on the job log tempfile to
644(readable and writable by us, readable by everyone else). This is relatively in line with the unix permissions policy for files created by the agent, which are generally created with relatively permissive permissions (usually 777), to be reduced by the umask. Given that job logs can be somewhat sensitive, I've chosen to have an explicitly lower permission set than usual for this specific file.Context
PS-276
Testing
go test ./...). Buildkite employees may check this if the pipeline has run automatically.go fmt ./...)