Security/high priority fixes#21
Open
EnesSenyurt wants to merge 2 commits into
Open
Conversation
State directory and log files previously used 0755/0640, exposing PID, config paths, fault patterns, and target identifiers to other local users. Switched to 0700/0600 to match the registry store's posture (pkg/registry/store.go already uses 0o700). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Windows does not enforce Unix-style permission bits; Mode().Perm() always returns 0666 for writable files regardless of the mode passed to os.WriteFile. Guard the 0600 assertion with runtime.GOOS check so the test passes on both platforms. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
State directory and log files were created with overly permissive modes (
0755/0640), allowing other local users to read engine state (PID, config paths, scenario details) and log files (target names, IPs, fault patterns). This PR restricts all.entropy/paths to user-only access, consistent with the registry store which already used0o700.Why is this change needed?
On multi-user systems (shared CI runners, developer VMs), world-readable state and group-readable logs expose chaos scenario details to unprivileged local users. This creates an information disclosure path that could be used to infer running fault injections or target topology.
How has this been tested?
TestStateManager_WriteAndReadvalidates0600on Linux; addedruntime.GOOSguard so the test also passes on Windows (NTFS does not enforce Unix permission bits)demo-distributedmicroservicesgo vet ./...passesChecklist
Changes
pkg/utils/state.go:58EnsureDir()—0755→0700pkg/utils/logger.go:310755→0700pkg/utils/logger.go:360640→0600pkg/cli/chaos.go:590640→0600pkg/utils/state_test.go