From b09f155f87137ef786900a5fb41901bd050aba18 Mon Sep 17 00:00:00 2001 From: garethgeorge Date: Wed, 24 Jan 2024 23:50:10 -0800 Subject: [PATCH] fix: chmod config 0600 such that only the creating user can read --- internal/config/jsonstore.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/internal/config/jsonstore.go b/internal/config/jsonstore.go index 247707ea..abcbcef5 100644 --- a/internal/config/jsonstore.go +++ b/internal/config/jsonstore.go @@ -33,8 +33,7 @@ func (f *JsonFileStore) Get() (*v1.Config, error) { } var config v1.Config - - if err = protojson.Unmarshal(data, &config); err != nil { + if err = (protojson.UnmarshalOptions{DiscardUnknown: true}).Unmarshal(data, &config); err != nil { return nil, fmt.Errorf("failed to unmarshal config: %w", err) } @@ -72,5 +71,10 @@ func (f *JsonFileStore) Update(config *v1.Config) error { return fmt.Errorf("failed to write config file: %w", err) } + // only the user running backrest should be able to read the config. + if err := os.Chmod(f.Path, 0600); err != nil { + return fmt.Errorf("chmod(0600) config file: %w", err) + } + return nil }